| name | cis-azure-database-2.9 |
| description | Ensure 'Access Keys Authentication' is set to 'Disabled' |
| category | cis-azure-database |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","redis","cache"] |
| cis_id | 2.9 |
| cis_benchmark | CIS Microsoft Azure Database Services Benchmark v2.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
2.9 Ensure 'Access Keys Authentication' is set to 'Disabled' (Automated)
Profile Applicability
Description
Ensure access key authentication is disabled for Azure Cache for Redis instances. Use Microsoft Entra for secure cache authentication.
Rationale
Access keys introduce security risks and management challenges, as they are long-lived secrets vulnerable to expose or misuse. Microsoft Entra authentication provides centralized identity and access management, reducing risk and improving overall security.
Impact
Disabling access key authentication terminates all existing client connections. Ensure retry mechanisms are in place for reconnection via Microsoft Entra.
Ensure Microsoft Entra authentication is enabled and configured before disabling access key authentication.
Refer to the recommendation in this section titled "Ensure 'Microsoft Entra Authentication' is 'Enabled'" for details.
Audit Procedure
Audit from Azure Portal
- Go to
Azure Cache for Redis.
- Select the name of a cache.
- Under Settings, select Authentication.
- Select Access keys.
- Ensure
Disable Access Keys Authentication is checked.
- Repeat steps 1-5 for each cache.
Audit from Azure CLI
Run the following command to list caches:
az redis list
For each cache, run the following command to get the disableAccessKeyAuthentication setting:
az redis show --resource-group <resource-group> --name <cache> --query disableAccessKeyAuthentication
Ensure true is returned.
Audit from PowerShell
Run the following command to list caches:
Get-AzRedisCache
Run the following command to get the cache in a resource group with a given name:
$cache = Get-AzRedisCache -ResourceGroupName <resource-group> -Name <cache>
Run the following command to get the DisableAccessKeyAuthentication setting:
$cache.DisableAccessKeyAuthentication
Ensure True is returned.
Repeat for each cache.
