Key Vault should use RBAC authorization

Medium Azure General keyvault-rbac

Applies to

Microsoft.KeyVault/vaults

What CGPulse checks

A resource passes this rule when enableRbacAuthorization must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Switch to Azure RBAC for finer-grained permissions and Azure AD integration. In Azure Portal: Key Vault > Access configuration > switch to Azure role-based access control. See: https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide

Careful: Switching to RBAC authorization disables all existing access policies. Ensure RBAC role assignments are configured before enabling

CLI

az keyvault update --ids "{id}" --enable-rbac-authorization true

Terraform

resource "azurerm_key_vault" "{name}" {
  name                       = "{name}"
  resource_group_name        = "{rg}"
  location                   = var.location
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  sku_name                   = "standard"
  enable_rbac_authorization  = true
}

Compliance frameworks

Cloud Security BaselinePA-7
Cloud Security: Azure Foundations
Critical Security Controls v86.8
GDPR: Data Protection Controls
HIPAA: Health Information Protection164.312(a)(1)
ISO 27001: Information SecurityA.9.2.3
NIST 800-53: Cloud Security ControlsAC-3
PCI DSS v4.07.2.1
SOC 2: Trust ServicesCC6.3
Well-Architected Cloud Review

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan