Back to Checks
azure

Key Vault uses Azure RBAC for access control

keyvault_rbac_enabled
Service: keyvaultSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:microsoft.keyvault/vaults

Azure Key Vault uses the Azure RBAC permission model for data-plane access to keys, secrets, and certificates, rather than legacy access policies.

Evaluates whether data access is managed through role assignments at the vault.

Prowler logoProwlerprowler-provider-azure

Risk

Without Azure RBAC, data access relies on coarse access policies. Control-plane Contributors can grant themselves data-plane rights, enabling secret or key exfiltration and unauthorized crypto operations.

Lack of JIT and least-privilege weakens confidentiality and integrity and hinders auditing.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks keyvault_rbac_enabled

Recommendation

Adopt Azure RBAC for Key Vault data access and design roles with least privilege at appropriate scopes (prefer vault-level per app/env). Use Privileged Identity Management for JIT, restrict control-plane Contributor rights, and monitor role assignments. Role assignments aren't preserved after soft-delete recovery.

Remediation

CLI

az keyvault update --name <KEY_VAULT_NAME> --resource-group <RESOURCE_GROUP_NAME> --enable-rbac-authorization true

Terraform

resource "azurerm_key_vault" "<example_resource_name>" {
  name                       = "<example_resource_name>"
  location                   = "<location>"
  resource_group_name        = "<example_resource_name>"
  tenant_id                  = "<tenant_id>"
  sku_name                   = "standard"
  enable_rbac_authorization  = true // Critical: enables Azure RBAC to satisfy the control
}

NativeIaC

// Enable Azure RBAC on a Key Vault
resource kv 'Microsoft.KeyVault/vaults@2023-07-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  properties: {
    tenantId: '<tenant_id>'
    enableRbacAuthorization: true // Critical: switches permission model to Azure RBAC to pass the check
    sku: {
      family: 'A'
      name: 'standard'
    }
  }
}

Other

1In Azure Portal, go to Key Vaults and open <KEY_VAULT_NAME>
2Under Settings, select Properties
3Set Permission model to Azure role-based access control
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.keyvault.keyvault_client import keyvault_client


class keyvault_rbac_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, key_vaults in keyvault_client.key_vaults.items():
            subscription_name = keyvault_client.subscriptions.get(
                subscription, subscription
            )
            for keyvault in key_vaults:
                report = Check_Report_Azure(metadata=self.metadata(), resource=keyvault)
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription_name} ({subscription}) is not using RBAC for access control."
                if (
                    keyvault.properties
                    and keyvault.properties.enable_rbac_authorization
                ):
                    report.status = "PASS"
                    report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription_name} ({subscription}) is using RBAC for access control."
                findings.append(report)
        return findings

References