Back to Checks
azure

Key Vault using private endpoints has public network access disabled

keyvault_access_only_through_private_endpoints
Service: keyvaultSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedtrust-boundaries
Resource Type:microsoft.keyvault/vaults

Azure Key Vaults configured with private endpoints have public network access set to Disabled, so connectivity occurs only over the private link.

Prowler logoProwlerprowler-provider-azure

Risk

Internet exposure alongside a private endpoint breaks isolation and expands attack surface:

  • Brute-force or token replay on the data plane
  • Abuse of misconfigured allowlists or trusted bypass
  • DDoS on the public endpoint This can enable secret exfiltration or unauthorized key use, impacting confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks keyvault_access_only_through_private_endpoints

Recommendation

Restrict access to private endpoints only:

  • Set publicNetworkAccess to Disabled
  • Avoid broad allowlists; limit Trusted services
  • Use private DNS with controlled egress
  • Enforce least privilege and monitor access logs This sustains defense in depth and prevents Internet exposure.

Remediation

CLI

az keyvault update --resource-group <resource_group> --name <vault_name> --public-network-access Disabled

Terraform

resource "azurerm_key_vault" "kv" {
  name                = "<example_resource_name>"
  location            = "<location>"
  resource_group_name = "<example_resource_name>"
  tenant_id           = "<tenant_id>"
  sku_name            = "standard"

  public_network_access_enabled = false # Critical: disables public access when using private endpoints
}

NativeIaC

// Disable public network access for the Key Vault
resource kv 'Microsoft.KeyVault/vaults@2023-07-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  properties: {
    tenantId: '<tenant_id>'
    sku: {
      name: 'standard'
      family: 'A'
    }
    publicNetworkAccess: 'Disabled' // Critical: disables public access so only private endpoints are used
  }
}

Other

1In the Azure portal, go to Key vaults and select your vault
2Open Networking
3Under Public access, set Public network access to Disabled
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.keyvault.keyvault_client import keyvault_client


class keyvault_access_only_through_private_endpoints(Check):
    """
    Ensure that Public Network Access when using Private Endpoint is disabled.

    This check evaluates whether Azure Key Vaults with private endpoints configured have
    public network access disabled. Disabling public network access enhances security by
    isolating the Key Vault from the public internet, thereby reducing its exposure.

    - PASS: The Key Vault has private endpoints and public network access is disabled.
    - FAIL: The Key Vault has private endpoints and public network access is enabled.
    """

    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, key_vaults in keyvault_client.key_vaults.items():
            subscription_name = keyvault_client.subscriptions.get(
                subscription, subscription
            )
            for keyvault in key_vaults:
                if (
                    keyvault.properties
                    and keyvault.properties.private_endpoint_connections
                ):
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=keyvault
                    )
                    report.subscription = subscription

                    if keyvault.properties.public_network_access_disabled:
                        report.status = "PASS"
                        report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription_name} ({subscription}) has public network access disabled and is using private endpoints."
                    else:
                        report.status = "FAIL"
                        report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription_name} ({subscription}) has public network access enabled while using private endpoints."
                    findings.append(report)
        return findings

References