Key Vault has a diagnostic setting with audit logging

# Enable diagnostic settings on Key Vault with audit + allLogs
resource "azurerm_monitor_diagnostic_setting" "<example_resource_name>" {
  name                       = "<example_resource_name>"
  target_resource_id         = "<example_resource_id>"           # Key Vault resource ID
  log_analytics_workspace_id = "<example_resource_id>"           # Destination workspace ID

  enabled_log {                                                  # critical: audit category group
    category_group = "audit"                                    # enables audit logs
  }
  enabled_log {                                                  # critical: allLogs category group
    category_group = "allLogs"                                  # enables all logs
  }
}

// Enable Key Vault diagnostic settings with audit + allLogs
param keyVaultName string
param workspaceId string

resource kv 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
  name: keyVaultName
}

resource diag 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  name: '<example_resource_name>'
  scope: kv
  properties: {
    workspaceId: workspaceId
    logs: [
      {
        categoryGroup: 'audit'   // critical: enables audit logs
        enabled: true            // required to pass the check
      }
      {
        categoryGroup: 'allLogs' // critical: enables allLogs group
        enabled: true            // required to pass the check
      }
    ]
  }
}