Key Vault Secret should be enabled

Applies to

• Microsoft.KeyVault/vaults/secrets

What CGPulse checks

A resource passes this rule when enabled must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable the secret or remove disabled secrets to maintain a clean vault. In Azure Portal: Key Vault > Secrets > select secret > enable or delete. See: https://learn.microsoft.com/en-us/azure/key-vault/secrets/about-secrets

CLI

az keyvault secret set-attributes --id "https://<vault-name>.vault.azure.net/secrets/<secret-name>" --enabled true

Bicep

resource secret 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {{
  parent: keyVault
  name: '<secret-name>'
  properties: {{
    attributes: {{
      enabled: true
    }}
  }}
}}

Terraform

resource "azurerm_key_vault_secret" "{name}" {
  name            = "<secret-name>"
  value           = "<secret-value>"
  key_vault_id    = azurerm_key_vault.{name}.id
  content_type    = "text/plain"
}

Compliance frameworks

• Cloud Security: Azure Foundations

Related Azure rules

• Action Group should be enabled
• Activity Log Alert should be enabled
• AKS cluster logs should be sent to Log Analytics
• AKS cluster must enable RBAC
• AKS cluster must enable RBAC
• AKS cluster should be a private cluster
• AKS cluster should disable local accounts
• AKS cluster should enable Azure RBAC for Kubernetes