Setup Alerts for Delete Key Vault Events

More Info:

Ensure that a Microsoft Azure activity log alert is fired whenever Delete Key Vault event is triggered inside your Microsoft Azure cloud account.

Risk Level

High

Address

Security

Compliance Standards

• Cloudanix Best Practice

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step by step instructions to remediate the misconfiguration “Setup Alerts for Delete Key Vault Events” for Azure using the Azure console:

1. Log in to the Azure portal (portal.azure.com) using your credentials.
2. Navigate to the Key Vaults service in the Azure portal.
3. Select the Key Vault for which you want to set up the alerts.
4. In the Key Vault menu, select “Monitoring” under the “Settings” section.
5. Click on “Alerts” and then click on “New alert rule”.
6. In the “Create rule” page, select “Key Vault” as the resource type and then select the specific Key Vault for which you want to set up the alerts.
7. Select the “Delete” event type under the “Event type” section.
8. Set the appropriate threshold and frequency for the alert rule.
9. In the “Actions” section, click on “Add action group” to create a new action group.
10. In the “Create action group” page, enter the required details such as the name of the action group, the email address or phone number to receive the alerts, and the severity level of the alerts.
11. Click on “Create” to create the action group, and then click on “OK” to close the “Create rule” page.
12. Your alert rule is now set up, and you will receive an alert whenever a delete event occurs in the specified Key Vault.

That’s it! You have successfully set up alerts for delete Key Vault events in Azure using the Azure console.

Using CLI

To remediate the misconfiguration “Setup Alerts for Delete Key Vault Events” in Azure using Azure CLI, follow these steps:

1. Open the Azure CLI on your local machine or in the Azure portal.

2. Login to your Azure account using the following command:

   az login
   

3. Once you have successfully logged in, set the default subscription to the one you want to work with using the following command:

   az account set --subscription <subscription_id>
   

4. Create an Azure Monitor action group that will be used to send notifications when a Key Vault is deleted. Use the following command to create an action group:

   az monitor action-group create --name <action_group_name> --short-name <short_name> --email <email_address> --webhook-properties "uri=<webhook_url>"
   

   Replace <action_group_name> with a name for the action group, <short_name> with a short name for the action group, <email_address> with an email address to receive notifications, and <webhook_url> with the URL of the webhook to receive notifications.

5. Create an Azure Monitor alert rule that will trigger when a Key Vault is deleted. Use the following command to create an alert rule:

   az monitor metrics alert create --name <alert_rule_name> --description <description> --resource <resource_id> --condition "metricName=DeletedVaults Count Total and aggregation=Total and threshold=1" --action <action_group_name>
   

   Replace <alert_rule_name> with a name for the alert rule, <description> with a description for the alert rule, <resource_id> with the ID of the resource to monitor, and <action_group_name> with the name of the action group created in step 4.

6. Verify that the alert rule has been created using the following command:

   az monitor metrics alert show --name <alert_rule_name> --resource <resource_id>
   

7. Test the alert rule by deleting a Key Vault and verifying that a notification is received.

By following these steps, you should be able to remediate the misconfiguration “Setup Alerts for Delete Key Vault Events” in Azure using Azure CLI.

Using Python

To remediate the misconfiguration “Setup Alerts for Delete Key Vault Events” in Azure using Python, you can follow the below steps:

Step 1: Install the Azure SDK for Python using the following command:

pip install azure

Step 2: Create a new Azure Resource Group using the following command:

from azure.common.credentials import UserPassCredentials
from azure.mgmt.resource import ResourceManagementClient
from azure.mgmt.resource.resources.models import ResourceGroup

subscription_id = '<subscription_id>'
credentials = UserPassCredentials('<username>', '<password>')

client = ResourceManagementClient(credentials, subscription_id)

resource_group_params = {'location':'eastus'}
resource_group = client.resource_groups.create_or_update('<resource_group_name>', ResourceGroup(**resource_group_params))

Step 3: Create a new Azure Monitor Action Group using the following command:

from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.monitor.models import ActionGroup, EmailReceiver

client = MonitorManagementClient(credentials, subscription_id)

action_group_params = {
    'email_receivers': [
        EmailReceiver(name='<email_receiver_name>', email_address='<email_address>')
    ]
}

action_group = client.action_groups.create_or_update('<action_group_name>', ActionGroup(**action_group_params))

Step 4: Create a new Azure Monitor Alert Rule using the following command:

from azure.mgmt.monitor.models import AlertRuleResource, AlertRuleAllOfCondition, \
    AlertRuleLeafCondition, AlertRuleAction

alert_rule_params = {
    'location': 'eastus',
    'description': 'Delete Key Vault Alert Rule',
    'condition': AlertRuleResource(condition=AlertRuleAllOfCondition(
        all_of=[AlertRuleLeafCondition(
            field='resourceType',
            equals='Microsoft.KeyVault/vaults',
            contains=None
        ),
            AlertRuleLeafCondition(
                field='operationName',
                equals='Microsoft.KeyVault/vaults/delete',
                contains=None
            )]
    )),
    'actions': [
        AlertRuleAction(action_group_id='<action_group_id>',
                        webhook_properties=None)
    ],
    'enabled': True
}

alert_rule = client.alert_rules.create_or_update('<resource_group_name>', '<alert_rule_name>', AlertRuleResource(**alert_rule_params))

Step 5: Verify that the alert rule has been created successfully in the Azure Portal.

By following these steps, you can remediate the misconfiguration “Setup Alerts for Delete Key Vault Events” in Azure using Python.

Using Terraform

resource "azurerm_monitor_activity_log_alert" "key_vault_delete" {
  name                = "KEY_VAULT_DELETE_ALERT_NAME" # replace with the alert name
  resource_group_name = "RESOURCE_GROUP_NAME"         # replace with the RG that will contain the alert
  scopes              = ["/subscriptions/SUBSCRIPTION_ID"] # replace with your subscription ID or specific scope(s)
  description         = "Alert when an Azure Key Vault is deleted"
  enabled             = true

  criteria {
    category       = "Administrative"
    operation_name = "Microsoft.KeyVault/vaults/delete"
    level          = "Warning" # or "Error"/"Informational" as required

    # Optional: further filters (e.g., specific resource group or vault)
    # resource_group = "KEY_VAULT_RESOURCE_GROUP_NAME"
    # resource_id    = "/subscriptions/SUBSCRIPTION_ID/resourceGroups/RG_NAME/providers/Microsoft.KeyVault/vaults/VAULT_NAME"
    # caller        = "UPN_OR_APPID_TO_FILTER_ON"
    # status        = "Succeeded"
    # sub_status    = "Created"
  }

  action {
    action_group_id = azurerm_monitor_action_group.key_vault_delete.id
  }

  tags = {
    ENVIRONMENT = "ENV_VALUE" # replace as needed
  }
}

resource "azurerm_monitor_action_group" "key_vault_delete" {
  name                = "KEY_VAULT_DELETE_ACTION_GROUP_NAME" # replace with name
  resource_group_name = "RESOURCE_GROUP_NAME"                # same or another RG for action group
  short_name          = "KVDELAG"                            # must be 12 chars or fewer

  email_receiver {
    name                    = "PRIMARY_EMAIL_RECEIVER"
    email_address           = "[e-mail]" # replace with destination email
    use_common_alert_schema = true
  }

  # Add other receivers as needed:
  # sms_receiver { ... }
  # webhook_receiver { ... }
  # arm_role_receiver { ... }
}

# This change does not force replacement of existing Key Vaults; it only adds/updates an alerting rule.
# Verification: `terraform plan` should show creation (or in-place update) of `azurerm_monitor_activity_log_alert.key_vault_delete`
# and `azurerm_monitor_action_group.key_vault_delete`, with `criteria.operation_name` set to "Microsoft.KeyVault/vaults/delete".

Additional Reading:

• https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-activity-log
• https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-log