Please see the additional information about the requirements needed before starting this remediation procedure. Remediate from Azure Portal - From Azure Home open the Portal Menu in the top left. - Select Key Vaults. - Select a Key Vault to audit. - Select Networking in the left column. - Select Private endpoint connections from the top row. - Select + Create - Select the subscription the Key Vault is within, and other desired configuration. - Select Next - For resource type select Microsoft.KeyVault/vaults - Select the Key Vault to associate the Private Endpoint with. - Select Next - In the Virtual Networking field, select the network to assign the Endpoint. - Select other configuration options as desired, including an existing or new application security group. - Select Next - Select the private DNS the Private Endpoints will use. - Select Next - Optionally add Tags - Select Next : Review + Create - Review the information and select Create Follow the Audit Procedure to determine if it has successfully applied. - Repeat steps 3-19 for each Key Vault. Remediate from Azure CLI - To create an endpoint, run the following command: az network private-endpoint create --resource-group --subnet --name --private-connection-resource-id "/subscriptions//resourceGroups//providers/Microsoft.KeyVault/vaults/" --group-ids vault --connection-name --location --manual-request - To manually approve the endpoint request, run the following command: az keyvault private-endpoint-connection approve --resource-group --vault-name -name - Determine the Private Endpoint's IP address to connect the Key Vault to the Private DNS you have previously created: - Look for the property networkInterfaces then id; the value must be placed in the variable within step 7. az network private-endpoint show -g -n - Look for the property networkInterfaces then id; the value must be placed on in step 7. az network nic show --ids - Create a Private DNS record within the DNS Zone you created for the Private Endpoint: az network private-dns record-set a add-record -g -z "privatelink.vaultcore.azure.net" -n -a - nslookup the private endpoint to determine if the DNS record is correct: nslookup .vault.azure.net nslookup .privatelink.vaultcore.azure.n Impact: Incorrect or poorly-timed changing of network configuration could result in service interruption. There are also additional costs tiers for running a private endpoint per petabyte or more of networking traffic.

Detections

Analytics

Item Search