logo

Database

Terraform Purge Protection Disabled

Description

Detects Azure Key Vaults that have purge protection disabled or not configured, which could allow permanent deletion of sensitive key material. Without purge protection, deleted keys, secrets and certificates can be permanently erased, preventing recovery even within the standard retention period.

Weakness:

101 - Lack of protection against deletion

Category: Functionality Abuse

Detection Strategy

    • Identifies 'azurerm_key_vault' resources in Terraform configurations

    • Reports a vulnerability if 'purge_protection_enabled' attribute is explicitly set to 'false'

    • Reports a vulnerability if 'purge_protection_enabled' attribute is missing/not configured

Vulnerable code example

resource "azurerm_key_vault" "vulnerable" {
  name                        = "examplekeyvault"
  location                    = "eastus"
  resource_group_name         = "example-rg"
  enabled_for_disk_encryption = true
  tenant_id                   = "tenant-id"
  soft_delete_retention_days  = 7
  purge_protection_enabled    = false  # Vulnerable: Disabled purge protection allows permanent deletion of secrets...

✅ Secure code example

resource "azurerm_key_vault" "secure" {
  name                        = "examplekeyvault"
  location                    = "eastus"
  resource_group_name         = "example-rg"
  enabled_for_disk_encryption = true
  tenant_id                   = data.azurerm_client_config.current.tenant_id  # Use dynamic tenant ID from current config
  soft_delete_retention_days  = 90                                           # Increased retention period for better security
  purge_protection_enabled    = true                                         # Enable purge protection to prevent permanent deletion...