DET-A9: Attestation-gated Key Vault key purged¶
A soft-deleted Key Vault key was purged. Purge is irreversible: the key the confidential VM releases through Secure Key Release cannot be recovered (DET-A8 covers the delete and disable that precede it), and a replacement can be created without the attested release policy.
| Property | Value |
|---|---|
| Severity | critical |
| Platform | Azure confidential VMs |
| Group | tee |
| Log source | Azure Key Vault · AuditEvent (KeyPurge) |
| Policy | P-03 |
| Related | AZURE-SKR-01 |
Fires when¶
Key Vault AuditEvent KeyPurge AND key IN attested_keys
How it runs¶
untrust detect --platform azure-cvm reads the Activity Log and Key Vault AuditEvent entries, live (with azure-mgmt-monitor and azure-identity installed) or from an exported file passed with --azure-log-file.
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.