liveBook · Manning

Azure Key Vault firewall

As explained in Azure Security

The Azure Key Vault firewall is a network access control feature that restricts requests to a key vault by IP address, subnet, or trusted Azure service.

The Azure Key Vault firewall controls network reachability to a vault by IP address, subnet, or trusted Azure service. New vaults have the firewall disabled, so network requests are broadly allowed by default; network reachability does not grant permission to perform operations. Authorization still requires Azure RBAC or an Azure Key Vault access policy. section 5.2.3 section 5.2.2

Restrict a vault to a VM subnet

Enable the Key Vault service endpoint on VMSubnet, add /virtualNetworks/VNET1/subnets/VMSubnet as a vault network rule, and set the vault's default action to Deny. The resulting network ACL shows defaultAction Deny and the permitted subnet under virtualNetworkRules.

How Azure Security covers it

How deep it goes
Explains defaults, subnet and IP rules, trusted-service bypass, CLI configuration, and resulting network ACLs.
Examples
Uses a VM subnet, an office IPv4 CIDR range, trusted Azure services, and network ACL command output.
What it assumes
Assumes an Azure Key Vault, VNet, subnet, and permitted identity; distinguishes network access from access-policy permissions.
What you can do after
Operate/configure a vault firewall with Azure CLI using subnet, IP range, bypass, and default-deny settings.
How it connects
Connects Azure Key Vault firewall rules with Azure RBAC, access policies, VNets, subnets, service endpoints, and IPv4 ranges.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.