New-AzKeyVault fails when built-in 'Key vaults should have soft delete enabled' Azure Policy is applied with 'Deny' effect

Open

#15,970 opened on Sep 28, 2021 11 comments 1 reaction 0 assignees View on GitHub

act-identity-squad Investigate :mag: KeyVault needs-team-attention

Dominant language: C#
Stars: 4.8k
Forks: 4.3k
Avg merge: 2d 17h
Merged PRs (30d): 51

Description

## Description
The `EnableSoftDelete` parameter in `New-AzKeyVault` was [removed as of Azure PowerShell 5.0](https://docs.microsoft.com/en-us/powershell/azure/release-notes-azureps?view=azps-6.4.0#500---october-2020) (Oct 2020) with the intention that soft delete would be enabled by default for all new Key Vaults.

Thus, it should be safe to apply an Azure Policy that rejects any ARM operations that would provision a new Key Vault without soft delete enabled. However, this is not the case and users are prevented from creating new Key Vaults, even when the operation would result in soft delete enabled due to the default behavior of the Key Vault resource provider.

This prevents our organization from properly enforcing that Key Vaults are only created with soft delete enabled.

## Steps to reproduce

1. Assign the built-in Azure Policy 'Key vaults should have soft delete enabled' (Definition ID: `/providers/Microsoft.Authorization/policyDefinitions/1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d`) to a subscription with the `effect` parameter set to `Deny`. This should prevent new Key Vaults that don't have soft-delete enabled from being created.

![image](https://user-images.githubusercontent.com/8740771/135157955-9084d154-5164-40a9-a16c-987df8fa2e9f.png)

2. Attempt to create a new Key Vault with Az.KeyVault version 3.5:

```powershell
PS > New-AzKeyVault -Name "" -ResourceGroupName "" -Location "West US 3"

New-AzKeyVault : Resource '' was disallowed by policy. Policy identifiers:
'[{"policyAssignment":{"name":"Key vaults should have soft delete enabled","id":"/providers/Microsoft.Management/manage
mentGroups//providers/Microsoft.Authorization/policyAssignments/"},"policyDefinition":{"name":"Key vaults should have soft delete enabled","id":"/providers/Microsoft.Authorization/policyDefinitions/"}}]'.
At line:1 char:1
+ New-AzKeyVault -Name "" -ResourceGroupName " ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [New-AzKeyVault], CloudException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.NewAzureKeyVault
```

## Notes
Note also that this version of PowerShell does not support explicitly setting the soft delete property:
```powershell
PS C:\Users\pshelton> New-AzKeyVault -Name "" -ResourceGroupName "" -Location "West US 3" -EnableSoftDelete $true
New-AzKeyVault : A parameter cannot be found that matches parameter name 'EnableSoftDelete'.
```

`New-AzureRmKeyVault` is properly blocked when the `EnableSoftDelete` flag is not supplied:
```powershell
PS > New-AzureRmKeyVault -Name "" -ResourceGroupName "" -Location "West US 3"
New-AzureRmKeyVault : Resource '' was disallowed by policy. Policy identifiers:
'[{"policyAssignment":{"name":"Key vaults should have soft delete enabled","id":"/providers/Microsoft.Management/manage
mentGroups//providers/Microsoft.Authorization/policyAssignments/"},"policyDefinition":{"name":"Key vaults should have soft delete enabled","id":"/providers/Microsoft.Authorization/policyDefinitions/"}}]'.
At line:1 char:1
+ New-AzureRmKeyVault -Name "" -ResourceGroupName " ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [New-AzureRmKeyVault], CloudException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.NewAzureKeyVault
````

but the request is properly allowed when the flag is supplied as expected:
```powershell
PS C:\Users\pshelton> New-AzureRmKeyVault -Name "" -ResourceGroupName "" -Location "West US 3" -EnableSoftDelete

VaultUri : https://.vault.azure.net
TenantId :
TenantName :
Sku : Standard
EnabledForDeployment : False
EnabledForTemplateDeployment : False
EnabledForDiskEncryption : False
EnableSoftDelete : True
```

## Environment data

```
Name Value
---- -----
PSVersion 5.1.19041.1237
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.19041.1237
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
```

## Module versions

```powershell
PS C:\Users\pshelton> Get-Module -ListAvailable

Directory: C:\Program Files\WindowsPowerShell\Modules

ModuleType Version Name
---------- -------
Script 2.5.3
Script 1.1.1
Script 2.4.0
Script 1.1.4
Script 2.3.0
Script 1.0.0
Script 1.2.0
Script 1.7.1
Script 3.1.0
Script 2.0.0
Script 1.8.0
Script 1.9.0
Script
Script 2.1.0
Script 2.2.3
Script 1.3.1
Script 1.1.0
Script 1.1.0
Script
Script 1.0.2
Script 1.3.0
Script 1.0.0
Script 1.1.0
Script 3.0.0
Script 1.0.2
Script 1.1.2
Script 1.3.0
Script 1.8.0
Script 1.8.0
Script 3.1.0
Script 4.3.0
Script 1.3.1
Script 2.7.3
Script 3.5.0
Script 2.0.0
Script 1.5.0
Script 1.1.3
Script 1.1.1
Script 2.0.0
Script 1.0.2
Script 1.1.1
Script 1.1.1
Script 2.7.0
Script
Script 1.1.1
Script 2.3.0
Script 1.4.1
Script 1.1.2
Script 1.0.3
Script 4.6.0
Script 1.5.0
Script 1.0.0
Script 1.0.3
Script 1.0.0
Script 4.3.1
Script 1.0.0
Script 1.1.0
Script 1.5.0
Script 3.0.1
Script 1.3.0
Script 3.5.0
Script 1.1.0
Script
Script 1.6.0
Script 2.0.0
Script 1.0.0
Script 1.0.4
Script 2.8.2
Script 5.1.2
Manifest 0.5.0
Script 4.2.1
Binary
Script 5.7.0 AzureRM
Script 0.6.6
Script 5.1.2
Script 0.1.3
Script 4.3.2
Script 4.0.4
Script 4.0.6
Script
Script 4.2.2
Script 0.9.4
Script 4.6.0
Script 0.3.1
Script 0.2.5
Script 1.0.4
Script 4.2.2
Script 0.5.3
Script 4.2.3
Script 5.2.0
Script 4.0.4
Script 4.1.2
Script 0.3.2
Script 0.6.3
Script 4.1.2
Script 4.0.4
Script 3.1.2
Script 4.3.0
Script 4.0.3
Script
Script 0.4.2
Script 0.2.1
Script 0.9.2
Script 5.4.2
Script 4.1.1
Script 4.3.2
Script 4.1.4
Script 4.6.0
Script 4.1.2
Script 4.1.2
Script 0.2.4
Script 4.1.2
Script 0.3.3
Script 5.5.2
Script
Script 4.1.2
Script 0.6.4
Script 0.3.4
Script 5.0.6
Script 4.4.0
Script 4.2.3
Script 4.0.4
Script 4.0.1
Script 4.0.3
Script 4.0.2
Script 4.2.2
Script 1.0.1
Binary
Script 3.4.0
Script
Script 2.0.0
``` ExportedCommands ---- ---------------- Az.Accounts {Disable-AzDataCollection, Disable-AzContextAutosave, Enab... Az.Advisor {Get-AzAdvisorRecommendation, Enable-AzAdvisorRecommendati... Az.Aks {Get-AzAksCluster, New-AzAksCluster, Remove-AzAksCluster, ... Az.AnalysisServices {Resume-AzAnalysisServicesServer, Suspend-AzAnalysisServic... Az.ApiManagement {Add-AzApiManagementApiToGateway, Add-AzApiManagementApiTo... Az.AppConfiguration {Get-AzAppConfigurationStore, Get-AzAppConfigurationStoreK... Az.ApplicationInsights {Get-AzApplicationInsights, New-AzApplicationInsights, Rem... Az.Automation {Get-AzAutomationHybridWorkerGroup, Remove-AzAutomationHyb... Az.Batch {Remove-AzBatchAccount, Get-AzBatchAccount, Get-AzBatchAcc... Az.Billing {Get-AzBillingInvoice, Get-AzBillingPeriod, Get-AzEnrollme... Az.Cdn {Get-AzCdnProfile, Get-AzCdnProfileSsoUrl, New-AzCdnProfil... Az.CognitiveServices {Get-AzCognitiveServicesAccount, Get-AzCognitiveServicesAc... 4.17.0 Az.Compute {Remove-AzAvailabilitySet, Get-AzAvailabilitySet, New-AzAv... Az.ContainerInstance {Add-AzContainerInstanceOutput, Get-AzContainerGroup, Get-... Az.ContainerRegistry {New-AzContainerRegistry, Get-AzContainerRegistry, Update-... Az.CosmosDB {Get-AzCosmosDBSqlContainer, Get-AzCosmosDBSqlContainerThr... Az.DataBoxEdge {Get-AzDataBoxEdgeJob, Get-AzDataBoxEdgeDevice, Invoke-AzD... Az.Databricks {Get-AzDatabricksVNetPeering, Get-AzDatabricksWorkspace, N... 1.14.0 Az.DataFactory {Set-AzDataFactoryV2, Update-AzDataFactoryV2, Get-AzDataFa... Az.DataLakeAnalytics {Get-AzDataLakeAnalyticsDataSource, New-AzDataLakeAnalytic... Az.DataLakeStore {Get-AzDataLakeStoreTrustedIdProvider, Remove-AzDataLakeSt... Az.DataShare {New-AzDataShareAccount, Get-AzDataShareAccount, Remove-Az... Az.DeploymentManager {Get-AzDeploymentManagerArtifactSource, New-AzDeploymentMa... Az.DesktopVirtualization {Disconnect-AzWvdUserSession, Expand-AzWvdMsixImage, Get-A... Az.DevTestLabs {Get-AzDtlAllowedVMSizesPolicy, Get-AzDtlAutoShutdownPolic... Az.Dns {Get-AzDnsRecordSet, New-AzDnsRecordConfig, Remove-AzDnsRe... Az.EventGrid {New-AzEventGridTopic, Get-AzEventGridTopic, Set-AzEventGr... Az.EventHub {New-AzEventHubNamespace, Get-AzEventHubNamespace, Set-AzE... Az.FrontDoor {New-AzFrontDoor, Get-AzFrontDoor, Set-AzFrontDoor, Remove... Az.Functions {Get-AzFunctionApp, Get-AzFunctionAppAvailableLocation, Ge... Az.HDInsight {Get-AzHDInsightJob, New-AzHDInsightSqoopJobDefinition, Wa... Az.HealthcareApis {New-AzHealthcareApisService, Remove-AzHealthcareApisServi... Az.IotHub {Add-AzIotHubKey, Get-AzIotHubEventHubConsumerGroup, Get-A... Az.KeyVault {Add-AzKeyVaultCertificate, Update-AzKeyVaultCertificate, ... Az.Kusto {Add-AzKustoClusterLanguageExtension, Add-AzKustoDatabaseP... Az.LogicApp {Get-AzIntegrationAccountAgreement, Get-AzIntegrationAccou... Az.MachineLearning {Move-AzMlCommitmentAssociation, Get-AzMlCommitmentAssocia... Az.Maintenance {Get-AzApplyUpdate, Get-AzConfigurationAssignment, Get-AzM... Az.ManagedServices {Get-AzManagedServicesAssignment, New-AzManagedServicesAss... Az.MarketplaceOrdering {Get-AzMarketplaceTerms, Set-AzMarketplaceTerms} Az.Media {Sync-AzMediaServiceStorageKey, Set-AzMediaServiceKey, Get... Az.Migrate {Get-AzMigrateDiscoveredServer, Get-AzMigrateJob, Get-AzMi... Az.Monitor {Get-AzMetricDefinition, Get-AzMetric, Remove-AzLogProfile... 4.11.0 Az.Network {Add-AzApplicationGatewayAuthenticationCertificate, Get-Az... Az.NotificationHubs {Get-AzNotificationHub, Get-AzNotificationHubAuthorization... Az.OperationalInsights {New-AzOperationalInsightsAzureActivityLogDataSource, New-... Az.PolicyInsights {Get-AzPolicyEvent, Get-AzPolicyState, Get-AzPolicyStateSu... Az.PowerBIEmbedded {Remove-AzPowerBIWorkspaceCollection, Get-AzPowerBIWorkspa... Az.PrivateDns {Get-AzPrivateDnsZone, Remove-AzPrivateDnsZone, Set-AzPriv... Az.RecoveryServices {Get-AzRecoveryServicesBackupProperty, Get-AzRecoveryServi... Az.RedisCache {Remove-AzRedisCachePatchSchedule, New-AzRedisCacheSchedul... Az.RedisEnterpriseCache {Export-AzRedisEnterpriseCache, Get-AzRedisEnterpriseCache... Az.Relay {New-AzRelayNamespace, Get-AzRelayNamespace, Set-AzRelayNa... Az.ResourceMover {Add-AzResourceMoverMoveResource, Get-AzResourceMoverMoveC... Az.Resources {Get-AzProviderOperation, Remove-AzRoleAssignment, Get-AzR... Az.Security {Get-AzSecurityAlert, Set-AzSecurityAlert, Get-AzSecurityA... Az.SecurityInsights {Get-AzSentinelAlertRuleAction, New-AzSentinelAlertRuleAct... Az.ServiceBus {New-AzServiceBusNamespace, Get-AzServiceBusNamespace, Set... Az.ServiceFabric {Add-AzServiceFabricClientCertificate, Add-AzServiceFabric... Az.SignalR {New-AzSignalR, Get-AzSignalR, Get-AzSignalRKey, New-AzSig... Az.Sql {Get-AzSqlDatabaseTransparentDataEncryption, Get-AzSqlData... Az.SqlVirtualMachine {New-AzSqlVM, Get-AzSqlVM, Update-AzSqlVM, Remove-AzSqlVM...} 3.11.0 Az.Storage {Get-AzStorageAccount, Get-AzStorageAccountKey, New-AzStor... Az.StorageSync {Invoke-AzStorageSyncCompatibilityCheck, New-AzStorageSync... Az.StreamAnalytics {Get-AzStreamAnalyticsCluster, Get-AzStreamAnalyticsCluste... Az.Support {Get-AzSupportService, Get-AzSupportProblemClassification,... Az.TrafficManager {Add-AzTrafficManagerCustomHeaderToEndpoint, Remove-AzTraf... Az.Websites {Get-AzAppServicePlan, Set-AzAppServicePlan, New-AzAppServ... Azure {Get-AzureAutomationCertificate, Get-AzureAutomationConnec... Azure.AnalysisServices {Add-AzureAnalysisServicesAccount, Restart-AzureAnalysisSe... Azure.Storage {Get-AzureStorageTable, New-AzureStorageTableSASToken, New... 2.0.2.140 AzureAD {Add-AzureADApplicationOwner, Get-AzureADApplication, Get-... AzureRM.AnalysisServices {Resume-AzureRmAnalysisServicesServer, Suspend-AzureRmAnal... AzureRM.ApiManagement {Add-AzureRmApiManagementRegion, Get-AzureRmApiManagementS... AzureRM.ApplicationInsights {Get-AzureRmApplicationInsights, New-AzureRmApplicationIns... AzureRM.Automation {Get-AzureRMAutomationHybridWorkerGroup, Get-AzureRmAutoma... AzureRM.Backup {Backup-AzureRmBackupItem, Enable-AzureRmBackupContainerRe... AzureRM.Batch {Remove-AzureRmBatchAccount, Get-AzureRmBatchAccount, Get-... 0.14.1 AzureRM.Billing {Get-AzureRmBillingInvoice, Get-AzureRmBillingPeriod, Get-... AzureRM.Cdn {Get-AzureRmCdnProfile, Get-AzureRmCdnProfileSsoUrl, New-A... AzureRM.CognitiveServices {Get-AzureRmCognitiveServicesAccount, Get-AzureRmCognitive... AzureRM.Compute {Remove-AzureRmAvailabilitySet, Get-AzureRmAvailabilitySet... AzureRM.Consumption Get-AzureRmConsumptionUsageDetail AzureRM.ContainerInstance {New-AzureRmContainerGroup, Get-AzureRmContainerGroup, Rem... AzureRM.ContainerRegistry {New-AzureRmContainerRegistry, Get-AzureRmContainerRegistr... AzureRM.DataFactories {Remove-AzureRmDataFactory, Get-AzureRmDataFactoryRun, Get... AzureRM.DataFactoryV2 {Set-AzureRmDataFactoryV2, Update-AzureRmDataFactoryV2, Ge... AzureRM.DataLakeAnalytics {Get-AzureRmDataLakeAnalyticsDataSource, New-AzureRmDataLa... AzureRM.DataLakeStore {Get-AzureRmDataLakeStoreTrustedIdProvider, Remove-AzureRm... AzureRM.DevTestLabs {Get-AzureRmDtlAllowedVMSizesPolicy, Get-AzureRmDtlAutoShu... AzureRM.Dns {Get-AzureRmDnsRecordSet, New-AzureRmDnsRecordConfig, Remo... AzureRM.EventGrid {New-AzureRmEventGridTopic, Get-AzureRmEventGridTopic, Set... AzureRM.EventHub {New-AzureRmEventHubNamespace, Get-AzureRmEventHubNamespac... AzureRM.HDInsight {Get-AzureRmHDInsightJob, New-AzureRmHDInsightSqoopJobDefi... AzureRM.Insights {Get-AzureRmMetricDefinition, Get-AzureRmMetric, Remove-Az... AzureRM.IotHub {Add-AzureRmIotHubKey, Get-AzureRmIotHubEventHubConsumerGr... AzureRM.KeyVault {Add-AzureKeyVaultCertificate, Set-AzureKeyVaultCertificat... AzureRM.LogicApp {Get-AzureRmIntegrationAccountAgreement, Get-AzureRmIntegr... 0.17.2 AzureRM.MachineLearning {Move-AzureRmMlCommitmentAssociation, Get-AzureRmMlCommitm... AzureRM.MachineLearningCompute {Get-AzureRmMlOpCluster, Get-AzureRmMlOpClusterKey, Test-A... AzureRM.MarketplaceOrdering {Get-AzureRmMarketplaceTerms, Set-AzureRmMarketplaceTerms} AzureRM.Media {Sync-AzureRmMediaServiceStorageKeys, Set-AzureRmMediaServ... AzureRM.Network {Add-AzureRmApplicationGatewayAuthenticationCertificate, G... AzureRM.NotificationHubs {Get-AzureRmNotificationHub, Get-AzureRmNotificationHubAut... AzureRM.OperationalInsights {New-AzureRmOperationalInsightsAzureActivityLogDataSource,... AzureRM.PowerBIEmbedded {Remove-AzureRmPowerBIWorkspaceCollection, Get-AzureRmPowe... AzureRM.Profile {Disable-AzureRmDataCollection, Disable-AzureRmContextAuto... AzureRM.RecoveryServices {Get-AzureRmRecoveryServicesBackupProperty, Get-AzureRmRec... AzureRM.RecoveryServices.Backup {Backup-AzureRmRecoveryServicesBackupItem, Get-AzureRmReco... AzureRM.RecoveryServices.SiteRec... {Edit-AzureRmRecoveryServicesAsrRecoveryPlan, Get-AzureRmR... AzureRM.RedisCache {Remove-AzureRmRedisCachePatchSchedule, New-AzureRmRedisCa... AzureRM.Relay {New-AzureRmRelayNamespace, Get-AzureRmRelayNamespace, Set... AzureRM.Resources {Get-AzureRmProviderOperation, Remove-AzureRmRoleAssignmen... 0.16.3 AzureRM.Scheduler {Disable-AzureRmSchedulerJobCollection, Enable-AzureRmSche... AzureRM.ServerManagement {Invoke-AzureRmServerManagementPowerShellCommand, Get-Azur... AzureRM.ServiceBus {New-AzureRmServiceBusNamespace, Get-AzureRmServiceBusName... AzureRM.ServiceFabric {Add-AzureRmServiceFabricApplicationCertificate, Add-Azure... AzureRM.SiteRecovery {Get-AzureRmSiteRecoveryFabric, New-AzureRmSiteRecoveryFab... AzureRM.Sql {Get-AzureRmSqlDatabaseTransparentDataEncryption, Get-Azur... AzureRM.Storage {Get-AzureRmStorageAccount, Get-AzureRmStorageAccountKey, ... AzureRM.StreamAnalytics {Get-AzureRmStreamAnalyticsFunction, Get-AzureRmStreamAnal... AzureRM.Tags {Remove-AzureRmTag, Get-AzureRmTag, New-AzureRmTag} AzureRM.TrafficManager {Disable-AzureRmTrafficManagerEndpoint, Enable-AzureRmTraf... AzureRM.UsageAggregates Get-UsageAggregates AzureRM.Websites {Get-AzureRmAppServicePlan, Set-AzureRmAppServicePlan, New... Microsoft.PowerShell.Operation.V... {Get-OperationValidation, Invoke-OperationValidation} 1.0.0.1 PackageManagement {Find-Package, Get-Package, Get-PackageProvider, Get-Packa... Pester {Describe, Context, It, Should...} 1.0.0.1 PowerShellGet {Install-Module, Find-Module, Save-Module, Update-Module...} PSReadline {Get-PSReadLineKeyHandler, Set-PSReadLineKeyHandler, Remov...

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

New-AzKeyVault fails when built-in 'Key vaults should have soft delete enabled' Azure Policy is applied with 'Deny' effect

Description

Contributor guide

Assessment

Get new issues in your inbox