Azure Key Vault 的 Azure Resource Graph 範例查詢

此頁面為 Azure Key Vault 的 Azure Resource Graph 查詢範例集。

範例查詢

計算金鑰保存庫資源

此查詢會使用 count 而不是 summarize 來計算所傳回的記錄數目。 只有金鑰保存庫會包含在計數中。

Resources
| where type =~ 'microsoft.keyvault/vaults'
| count

az graph query -q "Resources | where type =~ 'microsoft.keyvault/vaults' | count"

未啟用軟刪除的金鑰庫

此查詢用以識別未啟用軟刪除的金鑰保險庫，軟刪除是一項關鍵安全功能，能恢復已刪除的金鑰金庫物件。

Resources
| where type =~ 'microsoft.keyvault/vaults'
| where properties.enableSoftDelete == false or isnull(properties.enableSoftDelete)
| project name, resourceGroup, subscriptionId, location, properties.enableSoftDelete

az graph query -q "Resources | where type =~ 'microsoft.keyvault/vaults' | where properties.enableSoftDelete == false or isnull(properties.enableSoftDelete) | project name, resourceGroup, subscriptionId, location, properties.enableSoftDelete"

未啟用刪除保護功能的金鑰保管庫

此查詢會找到未啟用清除保護的金鑰庫。 建議在生產環境中啟用刪除保護，以防止在保留期間永久刪除金鑰保存庫物件。

Resources
| where type =~ 'microsoft.keyvault/vaults'
| where properties.enablePurgeProtection != true
| project name, resourceGroup, subscriptionId, location, softDeleteEnabled = properties.enableSoftDelete, purgeProtectionEnabled = properties.enablePurgeProtection

az graph query -q "Resources | where type =~ 'microsoft.keyvault/vaults' | where properties.enablePurgeProtection != true | project name, resourceGroup, subscriptionId, location, softDeleteEnabled = properties.enableSoftDelete, purgeProtectionEnabled = properties.enablePurgeProtection"

使用 RBAC 授權的金鑰庫

此查詢列出使用 Azure RBAC 授權而非存取政策的金鑰保管庫。 RBAC 授權是管理金鑰庫資料平面存取的推薦方法。

Resources
| where type =~ 'microsoft.keyvault/vaults'
| extend rbacEnabled = properties.enableRbacAuthorization
| project name, resourceGroup, subscriptionId, location, rbacEnabled
| where rbacEnabled == true

az graph query -q "Resources | where type =~ 'microsoft.keyvault/vaults' | extend rbacEnabled = properties.enableRbacAuthorization | project name, resourceGroup, subscriptionId, location, rbacEnabled | where rbacEnabled == true"

已啟用公共網路存取的金鑰保管庫

此查詢用以識別允許公共網路存取的金鑰保險庫。 為了提升安全性，可以考慮限制對特定網路的存取或使用私有端點。

Resources
| where type =~ 'microsoft.keyvault/vaults'
| extend networkDefaultAction = tostring(properties.networkAcls.defaultAction)
| where networkDefaultAction =~ 'Allow' or isnull(networkDefaultAction)
| project name, resourceGroup, subscriptionId, location, networkDefaultAction

az graph query -q "Resources | where type =~ 'microsoft.keyvault/vaults' | extend networkDefaultAction = tostring(properties.networkAcls.defaultAction) | where networkDefaultAction =~ 'Allow' or isnull(networkDefaultAction) | project name, resourceGroup, subscriptionId, location, networkDefaultAction"

金鑰保管庫的安全配置摘要

此查詢提供所有金鑰保險庫的完整安全態勢摘要，包括軟刪除狀態、清除保護、RBAC 授權及網路設定。

Resources
| where type =~ 'microsoft.keyvault/vaults'
| extend 
    softDeleteEnabled = tobool(properties.enableSoftDelete),
    purgeProtectionEnabled = tobool(properties.enablePurgeProtection),
    rbacEnabled = tobool(properties.enableRbacAuthorization),
    networkDefaultAction = tostring(properties.networkAcls.defaultAction),
    sku = tostring(properties.sku.name)
| project name, resourceGroup, subscriptionId, location, sku, softDeleteEnabled, purgeProtectionEnabled, rbacEnabled, networkDefaultAction
| order by name asc

az graph query -q "Resources | where type =~ 'microsoft.keyvault/vaults' | extend softDeleteEnabled = tobool(properties.enableSoftDelete), purgeProtectionEnabled = tobool(properties.enablePurgeProtection), rbacEnabled = tobool(properties.enableRbacAuthorization), networkDefaultAction = tostring(properties.networkAcls.defaultAction), sku = tostring(properties.sku.name) | project name, resourceGroup, subscriptionId, location, sku, softDeleteEnabled, purgeProtectionEnabled, rbacEnabled, networkDefaultAction | order by name asc"

按地點分類的密鑰保管庫

此查詢會依 Azure 區域分組的金鑰庫數，有助於了解金鑰管理資源的地理分布。

Resources
| where type =~ 'microsoft.keyvault/vaults'
| summarize count() by location
| order by count_ desc

az graph query -q "Resources | where type =~ 'microsoft.keyvault/vaults' | summarize count() by location | order by count_ desc"

依 SKU 類型劃分的金鑰庫

此查詢依照 SKU 層級（標準或高級）將金鑰保險庫分組。 HSM 保護的金鑰必須使用高級 SKU。

Resources
| where type =~ 'microsoft.keyvault/vaults'
| extend skuName = tostring(properties.sku.name)
| summarize count() by skuName

az graph query -q "Resources | where type =~ 'microsoft.keyvault/vaults' | extend skuName = tostring(properties.sku.name) | summarize count() by skuName"

金鑰保存庫與訂用帳戶名稱

下列查詢會顯示join 以 kind 作為 leftouter 的複雜用法。 此查詢會將聯結的資料表限制為訂用帳戶資源，並利用 project 使其僅包含原始欄位 subscriptionId 和已重新命名為 SubName 的 name 欄位。 欄位重新命名可避免 join 將它新增為 name1，因為此欄位已經存在於 resources 中。 原始資料表會使用 where 進行篩選，而下列 project 包含兩個資料表的資料行。 查詢結果顯示所有金鑰庫的類型、金鑰庫名稱以及其所屬訂閱的名稱。

Resources
| join kind=leftouter (ResourceContainers | where type=='microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId
| where type == 'microsoft.keyvault/vaults'
| project type, name, SubName

az graph query -q "Resources | join kind=leftouter (ResourceContainers | where type=='microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type == 'microsoft.keyvault/vaults' | project type, name, SubName"

後續步驟

  • 上次更新時間：