Description:
Azure Key Vault recoverability ensures that keys, secrets, and certificates can be restored after accidental deletion or disasters. Enabling soft-delete and purge protection allows recovery within a retention period and prevents permanent deletion until protection is disabled or retention expires.


Rationale:
Recoverability protects against accidental or malicious deletion. Soft-delete allows restoration within the retention period, and purge protection prevents permanent deletion, ensuring business continuity and compliance with standards like SOC 2, HIPAA, GDPR, and NIST.


Impact:
Deleted keys, secrets, and certificates can be recovered, but permanent deletion is not possible until the retention period expires once purge protection is enabled.


Default Value:
Soft delete is always enabled for Azure Key Vault and cannot be disabled. Purge protection is disabled by default unless enforced by policy.


Pre-requisites:

  • An existing Azure Key Vault

  • Permissions to modify Key Vault properties

Test Plan:

  1. Sign in to the Azure Portal at https://portal.azure.com

  2. Navigate to Key Vaults and select the applicable Key Vault.

  3. Open Properties under Settings.

  4. Verify that Soft delete is enabled.

  5. Verify that Purge protection is enabled.

  6. If not enabled, follow the implementation steps, mark the check as Fail.

Implementation steps:

  1. Sign in to the Azure Portal at https://portal.azure.com

  2. Navigate to Key Vaults and select the required Key Vault.

  3. Open Properties under Settings.

                                       

  1. Locate Purge protection and enable it.

  1. Save the configuration


Backout Plan:

There is no backout plan. Once purge protection is enabled on an Azure Key Vault, it cannot be disabled until the retention period expires.


References: