> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit keyvault vault resource lock remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Enable Azure Resource Locks" for Azure using the Azure console, you can follow these step-by-step instructions:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).

        2. Navigate to the resource group that you want to apply the lock to.

        3. Select the resource group and click on "Locks" under the "Settings" section in the left-hand menu.

        4. Click on the "+ Add" button to create a new lock.

        5. In the "Add lock" panel, provide a name for the lock and select the lock type as "CanNotDelete" from the dropdown menu.

        6. Optionally, you can add a description for the lock.

        7. Click on the "OK" button to create the lock.

        8. The lock is now applied to the resource group, and it will prevent any user from accidentally deleting any resources within the group.

        9. Repeat the above steps for all the resource groups that require a lock.

        By following these steps, you can remediate the misconfiguration "Enable Azure Resource Locks" for Azure using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of not having Azure Resource Locks enabled, you can follow these steps using Azure CLI:

        1. Open Azure CLI in your terminal or command prompt.
        2. Login to your Azure account using the command `az login`.
        3. Once you are logged in, you need to identify the resources that do not have resource locks enabled. You can do this by running the following command:
           ```
           az resource list --query "[?locks == null].{Name: name, ID: id, Type: type}"
           ```
           This command will list all the resources that do not have a resource lock enabled.
        4. Once you have identified the resources, you can enable resource locks by running the following command:
           ```
           az lock create --name <lock-name> --resource-group <resource-group-name> --resource-name <resource-name> --resource-type <resource-type> --lock-type CanNotDelete
           ```
           Here, you need to replace `<lock-name>` with a name for the lock, `<resource-group-name>` with the name of the resource group containing the resource, `<resource-name>` with the name of the resource, and `<resource-type>` with the type of the resource. The `--lock-type` parameter is set to `CanNotDelete` to prevent accidental deletion of the resource.
        5. Repeat step 4 for all the resources that do not have resource locks enabled.

        By following these steps, you can remediate the misconfiguration of not having Azure Resource Locks enabled.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of "Enable Azure Resource Locks" using Python, you can use the following steps:

        Step 1: Import the necessary libraries and authenticate to Azure using the Azure Identity library.

        ```
        from azure.identity import DefaultAzureCredential
        from azure.mgmt.resource import ResourceManagementClient
        from azure.mgmt.resource.resources.models import ManagementLockObject, LockLevel

        credential = DefaultAzureCredential()
        resource_client = ResourceManagementClient(credential, subscription_id)
        ```

        Step 2: Define the scope of the lock. In this example, we will define it at the resource group level.

        ```
        resource_group_name = 'my-resource-group'
        lock_name = 'my-lock-name'
        scope = f"/subscriptions/{subscription_id}/resourceGroups/{resource_group_name}"
        ```

        Step 3: Create a new lock object with the desired lock level and notes.

        ```
        lock_level = LockLevel.can_not_delete
        notes = 'This lock prevents accidental deletion of resources in the resource group.'
        lock_object = ManagementLockObject(level=lock_level, notes=notes)
        ```

        Step 4: Create the lock using the ResourceManagementClient.

        ```
        resource_client.management_locks.create_or_update(scope=scope, lock_name=lock_name, parameters=lock_object)
        ```

        Step 5: Verify that the lock was created successfully by checking the list of locks at the resource group level.

        ```
        locks = resource_client.management_locks.list_at_resource_group_level(resource_group_name)
        for lock in locks:
            print(lock.name)
        ```

        By following these steps, you can remediate the misconfiguration of "Enable Azure Resource Locks" using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Existing Key Vault (example)
        resource "azurerm_key_vault" "MISSION_CRITICAL_KV" {
          name                = "KV_NAME"           # replace with your Key Vault name
          resource_group_name = "RESOURCE_GROUP"    # replace with your RG name
          location            = "AZURE_REGION"      # e.g. "eastus"

          tenant_id = "TENANT_ID"                   # replace with your tenant ID
          sku_name  = "standard"

          # ...other required Key Vault settings...
        }

        # Resource lock to protect the Key Vault from deletion (and optionally modification)
        resource "azurerm_management_lock" "MISSION_CRITICAL_KV_LOCK" {
          name       = "KV_LOCK_NAME"               # e.g. "mission-critical-kv-lock"
          scope      = azurerm_key_vault.MISSION_CRITICAL_KV.id
          lock_level = "CanNotDelete"               # or "ReadOnly" if you also want to prevent updates
          notes      = "Protect mission critical Key Vault from accidental deletion."
        }
        ```

        This change does not force replacement of the Key Vault, but once applied, delete/modify operations blocked by the lock will require temporarily removing or relaxing the lock first.

        To verify, `terraform plan` should show creation of a new `azurerm_management_lock` attached to the Key Vault, with no replacement of the existing Key Vault resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>