cis-azure-database-2-9

name	cis-azure-database-2.9
description	Ensure 'Access Keys Authentication' is set to 'Disabled'
category	cis-azure-database
version	2.0.0
author	cyberstrike-official
tags	["cis","azure","redis","cache"]
cis_id	2.9
cis_benchmark	CIS Microsoft Azure Database Services Benchmark v2.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

2.9 Ensure 'Access Keys Authentication' is set to 'Disabled' (Automated)

Profile Applicability

• Level 1

Description

Ensure access key authentication is disabled for Azure Cache for Redis instances. Use Microsoft Entra for secure cache authentication.

Rationale

Access keys introduce security risks and management challenges, as they are long-lived secrets vulnerable to expose or misuse. Microsoft Entra authentication provides centralized identity and access management, reducing risk and improving overall security.

Impact

Disabling access key authentication terminates all existing client connections. Ensure retry mechanisms are in place for reconnection via Microsoft Entra.

Ensure Microsoft Entra authentication is enabled and configured before disabling access key authentication.

Refer to the recommendation in this section titled "Ensure 'Microsoft Entra Authentication' is 'Enabled'" for details.

Audit Procedure

Audit from Azure Portal

1. Go to Azure Cache for Redis.
2. Select the name of a cache.
3. Under Settings, select Authentication.
4. Select Access keys.
5. Ensure Disable Access Keys Authentication is checked.
6. Repeat steps 1-5 for each cache.

Audit from Azure CLI

Run the following command to list caches:

az redis list

For each cache, run the following command to get the disableAccessKeyAuthentication setting:

az redis show --resource-group <resource-group> --name <cache> --query disableAccessKeyAuthentication

Ensure true is returned.

Audit from PowerShell

Run the following command to list caches:

Get-AzRedisCache

Run the following command to get the cache in a resource group with a given name:

$cache = Get-AzRedisCache -ResourceGroupName <resource-group> -Name <cache>

Run the following command to get the DisableAccessKeyAuthentication setting:

$cache.DisableAccessKeyAuthentication

Ensure True is returned.

Repeat for each cache.