Key Vault uses private endpoints

Check ID: keyvault_private_endpoints
Provider: Azure
Service: keyvault
Severity: HIGH
Categories: internet-exposed, trust-boundaries
Resource type: microsoft.keyvault/vaults

What this check verifies

Azure Key Vault has private endpoint connections to serve secret and key operations over a private IP within your virtual network via Azure Private Link.

Risk

Without private endpoints, the vault relies on a public endpoint, expanding exposure to scanning and misconfigured allowlists. Egress controls are harder to enforce, enabling unauthorized secret retrieval for data exfiltration and potential key misuse, impacting confidentiality and integrity.

Recommendation

Enable Private Endpoints for each Key Vault and disable public network access. Use private DNS so the vault FQDN resolves to the private IP. Apply least privilege with RBAC and managed identities, restrict traffic with NSGs and routing, and monitor access logs as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az network private-endpoint create —name <example_resource_name> —resource-group <example_resource_name> —location <LOCATION> —vnet-name <example_resource_name> —subnet <example_resource_name> —private-connection-resource-id <example_resource_id> —group-ids vault —connection-name <example_resource_name>

# Create a Private Endpoint for an existing Key Vault
resource "azurerm_private_endpoint" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<LOCATION>"
  resource_group_name = "<example_resource_name>"
  subnet_id           = "<example_resource_id>" # Critical: subnet resource ID for the private endpoint NIC

  private_service_connection {
    name                           = "<example_resource_name>"
    private_connection_resource_id = "<example_resource_id>" # Critical: Key Vault resource ID to connect
    subresource_names              = ["vault"]               # Critical: targets Key Vault subresource to create the connection
  }
}

// Create a Private Endpoint for an existing Key Vault
resource pe 'Microsoft.Network/privateEndpoints@2021-08-01' = {
  name: '<example_resource_name>'
  location: '<LOCATION>'
  properties: {
    subnet: {
      id: '<example_resource_id>' // Critical: subnet resource ID where the private endpoint NIC will be placed
    }
    privateLinkServiceConnections: [
      {
        name: '<example_resource_name>'
        properties: {
          privateLinkServiceId: '<example_resource_id>' // Critical: Key Vault resource ID to connect to
          groupIds: [ 'vault' ] // Critical: targets the Key Vault subresource to create the private endpoint connection
        }
      }
    ]
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = keyvault_private_endpoints. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Secret in non-RBAC Key Vault has expiration date set Key Vault uses Azure RBAC for access control

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires