Check Details

• Resource: Azure Key Vault
• Check: Ensure Private Endpoint Access Is Enabled
• Risk: Without private endpoint access, Azure Key Vault may be exposed over the public internet. This increases the risk of unauthorized access, brute-force attacks, and data exfiltration of sensitive secrets, keys, and certificates.

Remediation via Azure Portal

1. Log in to the Azure Portal.
2. Navigate to Key Vaults and select the affected Key Vault.
3. In the left-hand menu, select Networking under Settings.
4. Under the Private endpoint connections tab, click + Create.
5. Configure the required virtual network and subnet, then complete the wizard to create the private endpoint.
6. Ensure that Public network access is set to Disabled (if business requirements allow).
7. Click Save to apply the configuration.

Remediation via Azure CLI

1. Open Azure Cloud Shell or a local terminal with Azure CLI installed.

2. Create a Private Endpoint for the Key Vault:

   

   az network private-endpoint create \
    --name <private-endpoint-name> \
    --resource-group <resource-group> \
    --vnet-name <vnet-name> \
    --subnet <subnet-name> \
    --private-connection-resource-id $(az keyvault show \
      --name <keyvault-name> \
      --resource-group <resource-group> \
      --query id -o tsv) \
    --group-id vault \
    --connection-name <connection-name>
   

3. Disable public network access for the Key Vault:

   

   az keyvault update \
    --name <keyvault-name> \
    --resource-group <resource-group> \
    --public-network-access Disabled
   

4. Verify network configuration:

   

   az keyvault show \
    --name <keyvault-name> \
    --resource-group <resource-group> \
    --query properties.publicNetworkAccess
   

Replace <resource-group>, <keyvault-name>, <vnet-name>, and <subnet-name> with your actual values.