> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Azure audit keyvault default network access enabled remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of Default Network Access being unrestricted in Azure, follow these steps: 1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)). 2. Navigate to the resource group that contains the resources you want to secure. 3. Select the Virtual Network that you want to secure. 4. Click on the "Firewalls and virtual networks" tab. 5. Under the "Firewalls and virtual networks" tab, select "Selected networks" to restrict access to the virtual network. 6. Under the "Selected networks" option, select "Add existing virtual network". 7. Select the virtual network that you want to allow access to and click "Add". 8. Under the "Firewalls and virtual networks" tab, select "Selected IP addresses" to restrict access to specific IP addresses. 9. Under the "Selected IP addresses" option, select "Add IP address range". 10. Enter the IP address range that you want to allow access to and click "Add". 11. Click "Save" to apply the changes. By following these steps, you have successfully remediated the misconfiguration of Default Network Access being unrestricted in Azure. # To remediate the misconfiguration of Default Network Access being unrestricted in Azure, you can follow these steps using Azure CLI: 1. Open the Azure CLI and login to your account using the command: ``` az login ``` 2. Once you have successfully logged in, set the scope to the subscription level using the command: ``` az account set --subscription ``` Replace `` with the ID of the subscription you want to work with. 3. Next, create a Network Security Group (NSG) using the command: ``` az network nsg create --name --resource-group ``` Replace `` with a unique name for the NSG and `` with the name of the resource group where you want to create the NSG. 4. Once the NSG is created, you can define inbound and outbound rules to restrict network access. For example, you can create a rule to allow traffic only from a specific IP address using the command: ``` az network nsg rule create --name --nsg-name --resource-group --priority 100 --source-address-prefixes --destination-port-ranges '*' ``` Replace `` with a unique name for the rule, `` with the name of the NSG you created in step 3, `` with the name of the resource group where the NSG is located, and `` with the IP address you want to allow traffic from. You can also create additional rules to allow traffic for specific ports and protocols. 5. Finally, associate the NSG with the appropriate subnet or network interface using the command: ``` az network vnet subnet update --name --vnet-name --resource-group --network-security-group ``` Replace `` with the name of the subnet you want to associate the NSG with, `` with the name of the virtual network where the subnet is located, `` with the name of the resource group where the virtual network is located, and `` with the name of the NSG you created in step 3. By following these steps, you can remediate the misconfiguration of Default Network Access being unrestricted in Azure. To remediate the misconfiguration of default network access being unrestricted in Azure using Python, you can follow the below steps: 1. Import the required libraries: ```python theme={null} from azure.identity import DefaultAzureCredential from azure.mgmt.network import NetworkManagementClient from azure.mgmt.network.models import NetworkSecurityGroup ``` 2. Authenticate to Azure using DefaultAzureCredential: ```python theme={null} credential = DefaultAzureCredential() network_client = NetworkManagementClient(credential, subscription_id) ``` 3. Get the Network Security Group (NSG) resource: ```python theme={null} nsg_name = "nsg_name" nsg_resource_group = "nsg_resource_group" nsg = network_client.network_security_groups.get(nsg_resource_group, nsg_name) ``` 4. Update the NSG rules to restrict default network access: ```python theme={null} # Remove the default allow-all inbound rule for rule in nsg.security_rules: if rule.name == "AllowVnetInBound": nsg.security_rules.remove(rule) # Add a new rule to allow only necessary traffic nsg.security_rules.append( { "name": "AllowNecessaryTraffic", "protocol": "*", "source_address_prefix": "*", "destination_address_prefix": "*", "access": "Allow", "direction": "Inbound", "priority": 100, "source_port_range": "*", "destination_port_range": "80,443", } ) # Update the NSG network_client.network_security_groups.begin_create_or_update(nsg_resource_group, nsg_name, nsg) ``` The above code will remove the default allow-all inbound rule from the NSG and add a new rule to allow only necessary traffic. You can modify the rule parameters as per your requirements. Finally, the NSG is updated using the `begin_create_or_update` method. ```hcl theme={null} resource "azurerm_key_vault" "this" { name = "KEY_VAULT_NAME" resource_group_name = azurerm_resource_group.RG_NAME.name location = azurerm_resource_group.RG_NAME.location tenant_id = "TENANT_ID" sku_name = "standard" # ...other required settings (access policies, RBAC, etc.)... network_acls { # Restrict default network access default_action = "Deny" # Optional: still allow trusted Azure services to reach the vault # Set to "None" if you want to deny *all* except explicit IPs/VNets. bypass = "AzureServices" # Optionally allow specific IPs # ip_rules = ["ALLOWED_PUBLIC_IP_CIDR"] # Optionally allow specific VNets/subnets # virtual_network_subnet_ids = [ # azurerm_subnet.ALLOWED_SUBNET.id, # ] } } ``` Substitute: * `KEY_VAULT_NAME` with your Key Vault name. * `RG_NAME` with the Terraform name of your resource group. * `TENANT_ID` with your Azure AD tenant ID. * Optionally `ALLOWED_PUBLIC_IP_CIDR` and `ALLOWED_SUBNET` with your allowed sources. Changing `network_acls.default_action` from `Allow` to `Deny` is an in-place update and does not force replacement of the Key Vault, but it can immediately block traffic that is not explicitly allowed. Verification: `terraform plan` should show an update on `azurerm_key_vault.this` changing `network_acls[0].default_action` from `"Allow"` (or absent) to `"Deny"` (and any configured `bypass`/rules as desired).