Cis Azure Storage 5.1.1

5.1.1 Ensure soft delete on Backup vaults is Enabled (Automated)

Description

Soft delete provides additional protection for Backup vault data. With soft delete enabled, deleted backup data can be recovered within the retention period.

Rationale

Important backup data could be accidentally deleted or removed by a malicious actor. With soft delete enabled, data is retained for at least 14 days before permanent deletion, allowing for the recovery of the backup data.

Impact

There is no additional cost for backup data in the soft delete state for up to and including 14 days. However, retention beyond 14 days may incur additional charges.

Audit Procedure

Audit from Azure Portal

1. Go to Backup vaults.
2. Click the name of a Backup vault.
3. Under Manage, click Properties.
4. Ensure Soft delete is set to Enabled or Enabled with Always-On.
5. Next to Soft delete, click Update.
6. Ensure that the Retention period is set to an appropriate value between 14 and 180, inclusive.
7. Repeat steps 1-6 for each Backup vault.

Audit from Azure CLI

Run the following command to list Backup vaults:

az dataprotection backup-vault list

For each Backup vault, run the following command:

az dataprotection backup-vault show --resource-group <resource-group> --vault-name <backup-vault>

Ensure that under softDeleteSettings, state is set to on or alwayson, and retentionDurationInDays is set to an appropriate value between 14 and 180, inclusive.

Audit from Azure Policy

If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions

• Policy ID: 9798d31d-6028-4dee-8643-46102185c016
• Name: '[Preview]: Soft delete should be enabled for Backup Vaults'

Expected Result

softDeleteSettings.state should be on or alwayson, and retentionDurationInDays should be between 14 and 180, inclusive.

Remediation

Remediate from Azure Portal

1. Go to Backup vaults.
2. Click the name of a Backup vault.
3. Under Manage, click Properties.
4. Next to Soft delete, click Update.
5. Check the box next to Soft delete.
6. In the box next to Retention period, set an appropriate number of days for deleted data to be retained, between 14 and 180, inclusive.
7. If it is appropriate for your organization, check the box next to Enable always-on soft delete. Note: Once enabled, this setting cannot be disabled.
8. Click Update.
9. Repeat steps 1-8 for each Backup vault requiring remediation.

Remediate from Azure CLI

Run the following command to list Backup vaults:

az dataprotection backup-vault list

For each Backup vault requiring remediation, run the following command to enable soft delete and set an appropriate number of days for deleted data to be retained, between 14 and 180, inclusive:

az dataprotection backup-vault update --resource-group <resource-group> --vault-name <backup-vault> --soft-delete-state On --retention-duration-in-days <retention-duration>

Note: To enable always-on soft delete, the above command can be executed with --soft-delete-state AlwaysOn. Once enabled, this setting cannot be disabled.

Default Value

Soft delete is enabled by default on newly created Backup vaults.

References

1. https://learn.microsoft.com/en-us/azure/backup/backup-vault-overview
2. https://learn.microsoft.com/en-us/azure/backup/backup-azure-enhanced-soft-delete-about
3. https://learn.microsoft.com/en-us/cli/azure/dataprotection/backup-vault

CIS Controls

Profile

Level 1 | Automated