cis-azure-foundations-8-3-11

name	cis-azure-foundations-8.3.11
description	Ensure Azure Resource Manager CanNotDelete Locks are considered for Key Vaults
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","security","key-vault","resource-locks"]
cis_id	8.3.11
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

8.3.11 Ensure Azure Resource Manager CanNotDelete Locks are considered for Key Vaults (Manual)

Description

Ensure that Azure Resource Manager CanNotDelete locks are applied to Key Vault resources to prevent accidental or unauthorized deletion of critical Key Vault instances.

Rationale

Azure Key Vaults contain critical cryptographic keys, secrets, and certificates that are essential for application security and operations. Accidental or malicious deletion of a Key Vault can cause catastrophic service outages and data loss. While soft delete and purge protection provide recovery capabilities, a CanNotDelete resource lock adds an additional layer of protection by preventing the deletion of the Key Vault resource entirely. The lock must be explicitly removed before the resource can be deleted, providing an additional administrative barrier against both accidental and intentional destruction.

Impact

Applying CanNotDelete locks means that the Key Vault cannot be deleted until the lock is removed. This requires explicit administrative action to remove the lock before deletion, which adds an additional step to any legitimate decommissioning process. Users with the Microsoft.Authorization/locks/* permission can remove locks. Organizations should ensure that lock management permissions are restricted to authorized personnel only.

Audit Procedure

From Azure Portal:

1. Go to Key vaults.
2. Click the name of a Key Vault.
3. Under Settings, click Locks.
4. Verify that a lock of type Delete (CanNotDelete) exists.

From Azure CLI:

az keyvault list --query "[].{Name:name, ResourceGroup:resourceGroup, Id:id}" -o tsv | while IFS=$'\t' read -r name rg id; do
    echo "Key Vault: $name"
    az lock list --resource-group "$rg" --resource-name "$name" --resource-type Microsoft.KeyVault/vaults --query "[?properties.level=='CanNotDelete'].{Name:name, Level:properties.level}" -o table
done

Ensure each Key Vault has a CanNotDelete lock.

For a specific vault:

az lock list --resource-group {resourceGroup} --resource-name {vaultName} --resource-type Microsoft.KeyVault/vaults --query "[?properties.level=='CanNotDelete']"

From PowerShell:

Get-AzKeyVault | ForEach-Object {
    $locks = Get-AzResourceLock -ResourceName $_.VaultName -ResourceGroupName $_.ResourceGroupName -ResourceType Microsoft.KeyVault/vaults | Where-Object { $_.Properties.Level -eq "CanNotDelete" }
    [PSCustomObject]@{
        VaultName = $_.VaultName
        HasDeleteLock = if ($locks) { "Yes" } else { "No" }
    }
}