Menu
Ensure that Data Factory is using Azure Key Vault to store Credentials and Secrets
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-database-4-3The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
| name | cis-azure-database-4.3 |
| description | Ensure that Data Factory is using Azure Key Vault to store Credentials and Secrets |
| category | cis-azure-database |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","data-factory","adf"] |
| cis_id | 4.3 |
| cis_benchmark | CIS Microsoft Azure Database Services Benchmark v2.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Azure Key Vault is a way to securely store secrets and keys, and create role based access control permissions to services and users to access them.
Use of Azure Key Vault is greatly recommended over less secure options like hard coding credentials into code.
This will create technical overhead as your organization will need to manage the lifecycle, expiration, and rotation of secrets and keys to fit your security baseline.
Data Factories select a factory to audit.Overview selection scroll down in the right pane and select Launch studio under Azure Data Factory Studio.Manage.Linked Services under Connections.If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure.
If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions
127ef6d7-242f-43b3-9eef-947faf1725d0 - Name: 'Azure Data Factory linked services should use Key Vault for storing secrets'A linked service connection to an Azure Key Vault should be present under Manage > Linked Services > Connections in Azure Data Factory Studio.
Azure Data Factories select a factory to link to an Azure Key Vault.> Settings and select Properties.Managed Identity Object ID and save this code for later.Note this presumes the use of RBAC Access control, not Access policies.
Key vaults select a key vault to grant access to.+ Add, and select Add role assignment from the dropdown.Role, search for key vault. Listed are various permissions to be assigned. Determine your organization's permission need, but Key Vault Reader is satisfactory for basic key and secrets access.Next.Assign access to, select Managed identity.+ Select members.Managed identity scroll to Data Factory and select it, or search by your Data Factory's name.Select.Review + assign.Data Factories select your data factory.Overview selection scroll down in the right pane and select Launch studio under Azure Data Factory Studio.Manage.Linked Services under Connections.+ New.Azure Key Vault and select it.Azure key vault selection method, choose From Azure Subscription.Authentication Method select System-assigned managed identity or User-assigned managed identity depending on what managed identity is in use on your data factory.Create.By default Azure Data Factories do not use Azure Key Vault to store credentials or secrets.