| name | cis-azure-storage-5.1.6 |
| description | Ensure 'Cross Subscription Restore' is set to 'Disabled' or 'Permanently Disabled' on Backup vaults |
| category | cis-azure-storage |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","storage","backup","backup-vaults","cross-subscription-restore","access-control"] |
| cis_id | 5.1.6 |
| cis_benchmark | CIS Microsoft Azure Storage Services Benchmark v1.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
5.1.6 Ensure 'Cross Subscription Restore' is set to 'Disabled' or 'Permanently Disabled' on Backup vaults (Automated)
Description
Disable cross subscription restore for Backup vaults to ensure that backup data can only be restored within the same subscription as the Backup vault, preventing restoration to targets in other subscriptions.
Rationale
Cross subscription restores increases security risks by widening access to sensitive backup data, potentially leading to accidental or intentional exposure, unauthorized access, or data exfiltration across environments.
Impact
Organizations may need to consider alternatives for disaster recovery scenarios, and if utilizing multiple subscriptions, may need to make adjustments or consider alternatives for data access. Costs could be incurred if alternative or additional backup infrastructure is required to account for the disabling of cross subscription restore.
Audit Procedure
Audit from Azure Portal
- Go to
Backup vaults.
- Click the name of a Backup vault.
- Under
Manage, click Properties.
- Under
Vault Settings, ensure that Cross Subscription Restore is set to Disabled or Permanently Disabled.
- Repeat steps 1-4 for each Backup vault.
Audit from Azure CLI
Run the following command to list Backup vaults:
az dataprotection backup-vault list
For each Backup vault, run the following command:
az dataprotection backup-vault show --resource-group <resource-group> --vault-name <backup-vault>
Ensure that under properties > featureSettings > crossSubscriptionRestoreSettings, state is set to Disabled or PermanentlyDisabled.
Audit from PowerShell
Run the following command to list Backup vaults:
Get-AzDataProtectionBackupVault
Run the following command to get the Backup vault in a resource group with a given name:
$vault = Get-AzDataProtectionBackupVault -ResourceGroupName <resource-group> -VaultName <backup-vault>
Run the following command to get the cross subscription restore setting for the Backup vault:
