cis-azure-database-2-7

name	cis-azure-database-2.7
description	Ensure Azure Cache for Redis is Using a Private Link
category	cis-azure-database
version	2.0.0
author	cyberstrike-official
tags	["cis","azure","redis","cache"]
cis_id	2.7
cis_benchmark	CIS Microsoft Azure Database Services Benchmark v2.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

2.7 Ensure Azure Cache for Redis is Using a Private Link (Manual)

Profile Applicability

• Level 2

Description

Private links make resources available via a private endpoint to a network you select. Tunneling between subscriptions, resource groups, without the need for traditional network routing.

Rationale

Networking communication should be segmented to prevent undesired interception.

Impact

If improperly configured network communication between your Azure Cache for Redis and other resources may be interrupted. This is only concerning resources or services being offered to other Azure tenants.

Audit Procedure

Audit From Azure Portal

1. Go to Azure Cache for Redis.
2. Select the name of a cache.
3. Expand the Administration menu in the left column.
4. Select Networking.
5. View the private endpoints associated with the cache.

Audit From PowerShell

1. Run the following code block with the identifying information for your environment.

Get-AzPrivateEndpoint -ResourceGroupName <ResourceGroupName> |
Where-Object{
$_.PrivateLinkServiceConnections.PrivateLinkServiceId -eq
<AzureCacheforRedisName>
}

2. View the private endpoints associated with the cache.

Audit From Azure Policy

• Policy ID: 960e650e-9ce3-4316-9590-8ee2c016ca2f - Name: 'Azure Cache for Redis should use private link'

Expected Result

At least one private endpoint should be associated with the Azure Cache for Redis instance.

Remediation

Remediate From Azure Portal

1. Go to Azure Cache for Redis.
2. Select the name of a cache.
3. In the left column expand Administration.
4. Select Networking.
5. In the top heading select Private Endpoints.
6. Select + Private Endpoint.
7. Select your subscription and resource group then select Next : Resource >.
8. Select Connect to an Azure resource in my directory.
9. Enter your subscription id or select from the dropdown.
10. Under Resource type select Microsoft.Cache/redisEnterprise from the dropdown.