Key vaults should have a firewall enabled
Azure Key Vault should have firewall enabled. Enable the key vault firewall so that the key vault is not accessible by default to any public IPs. Optionally, you can configure specific IP ranges to limit access to those networks.
Enable the key vault firewall so that the key vault is not accessible by default to any public IPs.
What this control checks
Checks whether each key vault has its firewall enabled
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.keyvault_firewall_enabled.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
NIST Cybersecurity Framework v2.0: Mapped to RC.RP-03 (The integrity of backups and other restoration assets is verified before using them for restoration.).
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
NIST Cybersecurity Framework v2.0
- RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration.
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 3.1.h Public Key Infrastructure (PKI)
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_firewall_enabled - Powerpipe Control:
azure_compliance.control.keyvault_firewall_enabled
Last reviewed: 2026-10-13