Azure managed identity has dangerous key vault role

azure

Set up the azure integration.

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Description

This rule detects Azure AD managed identities with dangerous key vault roles. It specifically detects the assignment of Key Vault Administrator and Key Vault Contributor.

Rationale

Assigning these key vault roles to Azure AD managed identities can unintentionally grant broad access to sensitive secrets, certificates, and encryption keys. Removing these assignments helps prevent privilege escalation, unauthorized access, and potential data breaches through misconfigured role assignments.

Remediation

Review the managed identities and assess whether the assigned roles are necessary. If access is not justified, remove the roles or assign more restrictive, least-privilege alternatives that align with the principle of minimum access.