Cis Azure Database 2.9

2.9 Ensure 'Access Keys Authentication' is set to 'Disabled' (Automated)

Profile Applicability

• Level 1

Description

Ensure access key authentication is disabled for Azure Cache for Redis instances. Use Microsoft Entra for secure cache authentication.

Rationale

Access keys introduce security risks and management challenges, as they are long-lived secrets vulnerable to expose or misuse. Microsoft Entra authentication provides centralized identity and access management, reducing risk and improving overall security.

Impact

Disabling access key authentication terminates all existing client connections. Ensure retry mechanisms are in place for reconnection via Microsoft Entra.

Ensure Microsoft Entra authentication is enabled and configured before disabling access key authentication.

Refer to the recommendation in this section titled "Ensure 'Microsoft Entra Authentication' is 'Enabled'" for details.

Audit Procedure

Audit from Azure Portal

1. Go to Azure Cache for Redis.
2. Select the name of a cache.
3. Under Settings, select Authentication.
4. Select Access keys.
5. Ensure Disable Access Keys Authentication is checked.
6. Repeat steps 1-5 for each cache.

Audit from Azure CLI

Run the following command to list caches:

az redis list

For each cache, run the following command to get the disableAccessKeyAuthentication setting:

az redis show --resource-group <resource-group> --name <cache> --query disableAccessKeyAuthentication

Ensure true is returned.

Audit from PowerShell

Run the following command to list caches:

Get-AzRedisCache

Run the following command to get the cache in a resource group with a given name:

$cache = Get-AzRedisCache -ResourceGroupName <resource-group> -Name <cache>

Run the following command to get the DisableAccessKeyAuthentication setting:

$cache.DisableAccessKeyAuthentication

Ensure True is returned.

Repeat for each cache.

Audit From Azure Policy

• Policy ID: 3827af20-8f80-4b15-8300-6db0873ec901 - Name: 'Azure Cache for Redis should not use access keys for authentication'

Expected Result

The Disable Access Keys Authentication checkbox should be checked, or CLI/PowerShell should return true/True.

Remediation

Remediate from Azure Portal

1. Go to Azure Cache for Redis.
2. Select the name of a cache.
3. Under Settings, select Authentication.
4. Select Access keys.
5. Check Disable Access Keys Authentication.
6. Select Save.
7. Select Yes to confirm.
8. Repeat steps 1-7 for each cache.

Remediate from Azure CLI

For each cache requiring remediation, run the following command to disable access key authentication:

az redis update --resource-group <resource-group> --name <cache> --set "disableAccessKeyAuthentication=true"

Remediate from PowerShell

For each cache requiring remediation, run the following command to disable access key authentication:

Set-AzRedisCache -ResourceGroupName <resource-group> -Name <cache> -DisableAccessKeyAuthentication $true

Default Value

By default, access key authentication is disabled.

References

1. https://learn.microsoft.com/en-gb/azure/azure-cache-for-redis/cache-azure-active-directory-for-authentication

CIS Controls

MITRE ATT&CK Mappings