Recovery Services vault should enable immutability

Medium Azure General recovery-vault-immutability

Applies to

Microsoft.RecoveryServices/vaults

What CGPulse checks

A resource passes this rule when immutabilityState must be one of ["Locked","Unlocked"]. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable immutability to prevent backup data modification or deletion before expiry. In Azure Portal: Recovery Services vault > Properties > enable Immutability. See: https://learn.microsoft.com/en-us/azure/backup/backup-azure-immutable-vault-concept

CLI

az backup vault resource-guard-mapping create --resource-group "{rg}" --vault-name "{name}" && az resource update --ids "{id}" --set properties.securitySettings.immutabilitySettings.state=Unlocked

Terraform

resource "azurerm_recovery_services_vault" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  sku                 = "Standard"
  immutability        = "Unlocked"
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan