| name | cis-azure-storage-5.2.7 |
| description | Ensure 'Cross Subscription Restore' is set to 'Disabled' or 'Permanently Disabled' on Recovery Services vaults |
| category | cis-azure-storage |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","storage","recovery-services","backup","cross-subscription-restore","access-control","data-exfiltration"] |
| cis_id | 5.2.7 |
| cis_benchmark | CIS Microsoft Azure Storage Services Benchmark v1.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
5.2.7 Ensure 'Cross Subscription Restore' is set to 'Disabled' or 'Permanently Disabled' on Recovery Services vaults (Automated)
Description
Disable cross subscription restore for Recovery Services vaults to ensure that backup data can only be restored within the same subscription as the Recovery Services vault, preventing restoration to targets in other subscriptions.
Rationale
Cross subscription restores increases security risks by widening access to sensitive backup data, potentially leading to accidental or intentional exposure, unauthorized access, or data exfiltration across environments.
Impact
Organizations may need to consider alternatives for disaster recovery scenarios, and if utilizing multiple subscriptions, may need to make adjustments or consider alternatives for data access. Costs could be incurred if alternative or additional backup infrastructure is required to account for the disabling of cross subscription restore.
Audit Procedure
Audit from Azure Portal
- Go to
Recovery Services vaults.
- Click the name of a Recovery Services vault.
- Under
Settings, click Properties.
- Under
Cross Subscription Restore, click Update.
- Ensure that
Disable Cross Subscription Restore or Permanently disable Cross Subscription Restore on this vault is selected.
- Repeat steps 1-5 for each Recovery Services vault.
Audit from Azure CLI
Run the following command to list Recovery Services vaults:
az backup vault list
For each Recovery Services vault, run the following command:
az backup vault show --resource-group <resource-group> --name <recovery-services-vault>
Ensure that under properties > restoreSettings > crossSubscriptionRestoreSettings, crossSubscriptionRestoreState is set to Disabled or PermanentlyDisabled.
Audit from PowerShell
Run the following command to list Recovery Services vaults:
Get-AzRecoveryServicesVault
Run the following command to get the Recovery Services vault in a resource group with a given name:
$vault = Get-AzRecoveryServicesVault -ResourceGroupName <resource-group> -Name <recovery-services-vault>
