App Tier Customer-Managed Key In Use

Trend Micro Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 750 automated best practice checks.

Risk level: High (not acceptable risk)
Rule ID: KeyVault-008

Ensure that a Customer-Managed Key (CMK), also known as Bring Your Own Key (BYOK), is created and configured for your Microsoft Azure application tier in order to meet cloud security and compliance requirements within your organization. This conformity rule assumes that all the Azure cloud resources available in your app tier are tagged with <app_tier_tag>:<app_tier_tag_value>, where <app_tier_tag> represents the tag name and <app_tier_tag_value> represents the tag value. Prior to running this rule by the Cloud Conformity engine, the tag set defined for your Azure application tier must be configured in the rule settings, on the Cloud Conformity console.

This rule resolution is part of the Cloud Conformity Security & Compliance tool for Azure

Security

When you use your own Azure Customer-Managed Key to protect the data available at rest within your app tier, you gain full control over who can use this key to access the application data, implementing the principle of least privilege on the encryption key ownership and usage. Cloud Conformity highly recommends creating and configuring at least one Customer-Managed Key (CMK)/Bring Your Own Key (BYOK) for your Azure cloud application tier

Note: Make sure that you replace all <app_tier_tag>:<app_tier_tag_value> tag placeholders found in this conformity rule with your own tag name and value created for the app tier.


Audit

To determine if an app-tier Customer Master Key exists in your Microsoft Azure cloud account, perform the following actions:

Using Azure Portal

01 Sign in to your Cloud Conformity console, access App Tier Customer-Managed Key In Use conformity rule settings and identify the tag set defined for the Azure cloud resources provisioned in your app tier (e.g. <app_tier_tag>:<app_tier_tag_value>).

02 Sign in to Azure Management Portal.

03 Navigate to All resources blade at https://portal.azure.com/#blade/HubsExtension/BrowseAll to access all your Microsoft Azure resources.

04 Choose the Azure subscription that you want to access from the Subscription filter box.

05 From the Type filter box, select Key vault to list all Key Vault instances available in the selected subscription.

06 Click on the name of the Azure Key Vault that you want to examine.

07 In the navigation panel, under Settings, select Keys, to access the Customer-Managed Keys (CMKs) deployed within the selected vault.

08 Choose the active CMK that you want to examine, then click on the current (latest) version of the key, to access the key configuration details.

09 On the selected key configuration page, choose the Tags tab and check the tag set created for the selected CMK. If the tag set does not match the one identified at step no. 1 or the key does not have any tags defined at all, the selected Customer Master Key (CMK) is not an app-tier resource.

10 Repeat step no. 8 and 9 for each CMK deployed in the selected Azure Key Vault.

11 Repeat steps no. 6 – 10 for each Key Vault available in the selected subscription. If none of the verified keys have the required app-tier tags, there is no Azure Customer Master Key (CMK) created and configured for your application tier, within the selected Azure subscription.

12 Repeat steps no. 4 – 11 for each subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Sign in to your Cloud Conformity console, access App Tier Customer-Managed Key In Use conformity rule settings and identify the tag set defined for the Azure cloud resources provisioned in your app tier (e.g. <app_tier_tag>:<app_tier_tag_value>).

02 Run keyvault list command (Windows/macOS/Linux) using custom query filters to list the names of all Key Vault instances available in the current Azure subscription:

az keyvault list
	--query '[*].name'

03 The command output should return the requested Azure resource names:

[
  "cc-project5-key-vault",
  "cc-user-access-vault"
]

04 Run keyvault key list command (Windows/macOS/Linux) using the name of the Azure Key Vault instance that you want to examine as identifier parameter and custom query filters to list the IDs of the Customer Master Keys (CMKs) available in the selected vault:

az keyvault key list
	--vault-name "cc-project5-key-vault"
	--query '[?(attributes.enabled==`true`)].kid'

05 The command output should return the requested CMK identifiers (IDs):

[
 "https://cc-project5-key-vault.vault.azure.net/keys/cc-development-cmk",
 "https://cc-project5-key-vault.vault.azure.net/keys/cc-project5-cmk"
]

06 Run keyvault key show command (Windows/macOS/Linux) using the ID of the Azure Customer Master Key that you want to examine as identifier parameter and custom query filters to describe the tag set(s) defined for the selected Azure resource:

az keyvault key show
	--id "https://cc-project5-key-vault.vault.azure.net/keys/cc-development-cmk"
	--query 'tags'

07 The command output should return an object that contains the tag set(s) configured for the selected CMK:

{
  "ProjectName": "Project5"
}

Check the tags object returned by the keyvault key show command output. If none of the tag sets returned by the command output match the tags identified at step no. 1 or the verified key does not have any tags and an empty object is returned instead (i.e. {}), the selected Customer Master Key (CMK) is not an app-tier resource.

08 Repeat step no. 6 and 7 for each CMK created within the selected Azure Key Vault.

09 Repeat steps no. 4 – 8 for each Key Vault available in the selected subscription. If none of the verified keys have the necessary app-tier tags, there is no Azure Customer Master Key (CMK) created and configured for your application tier, within the selected Azure subscription.

10 Repeat steps no. 2 – 9 for each subscription available in your Microsoft Azure cloud account.

Remediation / Resolution

To create and configure a dedicated Customer-Managed Key (CMK) to be used by the Azure cloud resources provisioned within your application tier, perform the following actions:

Using Azure Portal

01 Sign in to your Cloud Conformity console, access App Tier Customer-Managed Key In Use conformity rule settings and copy the tag set defined for the cloud resources created within your application tier (e.g. <app_tier_tag>:<app_tier_tag_value>).

02 Sign in to Azure Management Portal.

03 Navigate to All resources blade at https://portal.azure.com/#blade/HubsExtension/BrowseAll to access all your Microsoft Azure resources.

04 Choose the Azure subscription that you want to access from the Subscription filter box.

05 From the Type filter box, select Key vault to list all Key Vault instances available in the selected subscription.

06 Click on the name of the Azure Key Vault that you want to access.

07 In the navigation panel, under Settings, select Keys, then click on the Generate/Import button from the dashboard top menu to initiate the Customer-Managed Key setup process.

08 On the Create a key page, perform the following operations:

  1. Select Generate from the Options dropdown list to generate a new key.
  2. In the Name box, provide a unique name for your new CMK.
  3. Select RSA from the Key Type and 2048 from the RSA Key Size.
  4. Set an activation and/or expiration date for the resource using the Set activation date and Set expiration date controls.
  5. Select Yes for Enabled to activate the key immediately after creation.
  6. Click Create to generate your new Customer-Managed Key (CMK).

09 Select the newly created CMK, then click on the current version of the key to access the resource latest configuration.

10 On the selected key configuration page, choose the Tags tab and use the Tag Name and Tag Value fields to create tags that will help organize the identity of the new CMK. Use the following format when you define your own tag set: <app_tier_tag>:<app_tier_tag_value> and make sure the tag name (<app_tier_tag>) and the tag value (<app_tier_tag_value>) match the tag set used to organize your app-tier cloud resources, copied at step no. 1. Click Ok to apply the tag set.

11 If required, repeat steps no. 4 – 10 to create new, dedicated app-tier Customer-Managed Keys (CMKs) for other subscriptions available in your Microsoft Azure cloud account.

Using Azure CLI

01 Sign in to your Cloud Conformity console, access App Tier Customer-Managed Key In Use conformity rule settings and copy the tag set defined for the cloud resources created within your application tier (e.g. <app_tier_tag>:<app_tier_tag_value>).

02 Run keyvault key create command (Windows/macOS/Linux) to create the new Customer-Managed Key (CMK)/Bring Your Own Key (BYOK) required by the Microsoft Azure cloud resources provisioned inside your application tier, in the current Azure subscription. Use the following format when you define your own tag set: <app_tier_tag>:<app_tier_tag_value> and make sure the tag name (app_tier_tag) and the tag value (app_tier_tag_value) match the tag set used to organize your app-tier resources, copied at step no. 1:

az keyvault key create
	--name cc-app-tier-cmk
	--vault-name cc-project5-key-vault
	--kty RSA
	--size 2048
	--ops decrypt encrypt sign unwrapKey verify wrapKey
	--expires "2020-12-17T20:00:00Z"
	--protection software
	--disabled false
	--tags app_tier_tag=app_tier_tag_value

03 The command output should return the configuration metadata for the new app-tier key:

{
  "attributes": {
    "created": "2019-12-17T20:00:10+00:00",
    "enabled": true,
    "expires": "2020-12-17T20:00:00+00:00",
    "notBefore": null,
    "recoveryLevel": "Purgeable",
    "updated": "2019-12-17T20:00:10+00:00"
  },
  "key": {
    "crv": null,
    "d": null,
    "dp": null,
    "dq": null,
    "e": "AQAB",
    "k": null,
    "keyOps": [
      "decrypt",
      "encrypt",
      "sign",
      "unwrapKey",
      "verify",
      "wrapKey"
    ],
    "kid": "https://cc-project5-key-vault.vault.azure.net/keys/cc-app-tier-cmk/abcdabcdabcdabcdabcdabcdabcdabcd",
    "kty": "RSA",
    "n": "...",
    "p": null,
    "q": null,
    "qi": null,
    "t": null,
    "x": null,
    "y": null
  },
  "managed": null,
  "tags": {
    "app_tier_tag": "app_tier_tag_value"
  }
}

04 If required, repeat step no. 2 and 3 to create new, dedicated app-tier Customer-Managed Keys (CMKs) for other subscriptions available in your Microsoft Azure cloud account.

References

Publication date Aug 31, 2020

Unlock the Remediation Steps


Gain free unlimited access
to our full Knowledge Base


Over 750 rules & best practices
for AWS and Azure

You are auditing:

App Tier Customer-Managed Key In Use

Risk level: High