メニュー
Ensure 'Cross Subscription Restore' is set to 'Disabled' or 'Permanently Disabled' on Backup vaults
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-storage-5-1-6コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
SOC 職業分類に基づく
| name | cis-azure-storage-5.1.6 |
| description | Ensure 'Cross Subscription Restore' is set to 'Disabled' or 'Permanently Disabled' on Backup vaults |
| category | cis-azure-storage |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","storage","backup","backup-vaults","cross-subscription-restore","access-control"] |
| cis_id | 5.1.6 |
| cis_benchmark | CIS Microsoft Azure Storage Services Benchmark v1.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Disable cross subscription restore for Backup vaults to ensure that backup data can only be restored within the same subscription as the Backup vault, preventing restoration to targets in other subscriptions.
Cross subscription restores increases security risks by widening access to sensitive backup data, potentially leading to accidental or intentional exposure, unauthorized access, or data exfiltration across environments.
Organizations may need to consider alternatives for disaster recovery scenarios, and if utilizing multiple subscriptions, may need to make adjustments or consider alternatives for data access. Costs could be incurred if alternative or additional backup infrastructure is required to account for the disabling of cross subscription restore.
Backup vaults.Manage, click Properties.Vault Settings, ensure that Cross Subscription Restore is set to Disabled or Permanently Disabled.Run the following command to list Backup vaults:
az dataprotection backup-vault list
For each Backup vault, run the following command:
az dataprotection backup-vault show --resource-group <resource-group> --vault-name <backup-vault>
Ensure that under properties > featureSettings > crossSubscriptionRestoreSettings, state is set to Disabled or PermanentlyDisabled.
Run the following command to list Backup vaults:
Get-AzDataProtectionBackupVault
Run the following command to get the Backup vault in a resource group with a given name:
$vault = Get-AzDataProtectionBackupVault -ResourceGroupName <resource-group> -VaultName <backup-vault>
Run the following command to get the cross subscription restore setting for the Backup vault:
$vault.CrossSubscriptionRestoreState
Ensure that the command returns Disabled or PermanentlyDisabled.
Repeat for each Backup vault.
If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions
4d479a11-f2b5-4f0a-bb1e-d2332aa95cdaCross Subscription Restore should be Disabled or Permanently Disabled in the Azure Portal, or properties.featureSettings.crossSubscriptionRestoreSettings.state should be Disabled or PermanentlyDisabled in CLI output, or $vault.CrossSubscriptionRestoreState should return Disabled or PermanentlyDisabled in PowerShell.
Backup vaults.Manage, click Properties.Disable Cross Subscription Restore or Permanently disable Cross Subscription Restore on this vault.Are you sure you want to permanently disable Cross Subscription Restore? Once disabled, it cannot be re-enabled.Update.For each Backup vault requiring remediation, run the following command to disable cross subscription restore:
az dataprotection backup-vault update --resource-group <resource-group> --vault-name <backup-vault> --cross-subscription-restore-state Disabled
Note: Use --cross-subscription-restore-state PermanentlyDisabled with the above command to permanently disable cross subscription restore.
For each Backup vault requiring remediation, run the following command to disable cross subscription restore:
Update-AzDataProtectionBackupVault -ResourceGroupName <resource-group> -VaultName <backup-vault> -CrossSubscriptionRestoreState Disabled
Note: Use -CrossSubscriptionRestoreState PermanentlyDisabled with the above command to permanently disable cross subscription restore.
Cross subscription restore is enabled by default on Backup vaults.
If cross subscription restore is permanently disabled on a vault, it cannot be re-enabled.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control Lists | X | X | X |
| v7 | 14.6 Protect Information through Access Control Lists | X | X | X |
Level 1 | Automated