Sign in Start Free Trial

Terraform Modules for AWS

AWS Compliance Frameworks

AWS Compliance Controls

Azure Compliance Frameworks

Azure Compliance Controls

Azure Key Vaults should use private link Key vault certificates should have 'Validity Period (in months)' set to 12 or less Key Vault keys should have an expiration date Key vault keys should have automatic rotation enabled Key Vault Managed HSMs should have purge protection enabled Key Vault Managed HSMs should have resource logs enabled Key Vault secrets should have an expiration date Key vaults should have a firewall enabled Key vaults should have deletion protection enabled Key vaults should have public network access disabled Key vaults should have recoverability configured Key vaults should have resource logs enabled Key vaults should have Role-Based Access Control (RBAC) enabled Key vaults should have soft delete enabled Key vaults should use a virtual network service endpoint Non-RBAC key vaults should have 'Expiration Date' configured for all keys Non-RBAC key vaults should have 'Expiration Date' configured for all secrets RBAC key vaults should have 'Expiration Date' configured for all keys RBAC key vaults should have 'Expiration Date' configured for all secrets

Google Cloud Compliance Frameworks

Google Cloud Compliance Controls

Azure Compliance ControlsAzure Key Vault

Key Vault Managed HSMs should have resource logs enabled

Resource logs in Azure Key Vault Managed HSM should be enabled. To recreate activity trails for investigation purposes when a security incident occurs or when your network is compromised, you may want to audit by enabling resource logs on Managed HSMs.

What this control checks

Resource logs in Azure Key Vault Managed HSM should be enabled.

Framework mappings

The clauses this control is mapped to in each framework.

HIPAA HITRUST v9.2

1211.09aa3System.4-09.aa 09.10 Monitoring

Related controls

Key vaults should have deletion protection enabled
App Service apps should have 'HTTP logs' enabled

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: keyvault_managed_hms_logging_enabled
Powerpipe Control: azure_compliance.control.keyvault_managed_hms_logging_enabled

Last reviewed: 2026-10-13

View all Azure controls →

Key Vault Managed HSMs should have purge protection enabled

Previous Page

Key Vault secrets should have an expiration date

Next Page

On this page

Implementation What this control checks Framework mappings Related controls Tool mappings

Ask AI about this

Ask Claude
Ask ChatGPT

Help improve this page

Suggest an edit
Share on LinkedIn

Copyright © 2024-2026 Betajob AS 🇺🇦Build: 20261018_075822_200685

Go to compliance.tf·Registry·Pricing·License Agreement··