OpenParable
Skip to content
← Back to skills

Cis Azure Database 2.5

DevOps & Security
cis-azure-database-2.5

Cis Azure Database 2.5 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure that 'System Assigned Managed Identity' is set to 'On'

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Database_Services_Benchmark_v2.0.0/cis-azure-database-2.5/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-azure-database-2-5, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

2.5 Ensure that 'System Assigned Managed Identity' is set to 'On' (Manual)

Profile Applicability

  • Level 1

Description

System Assigned Managed Identities provide the Azure Cache for Redis instance with a unique account like a service principle but automatically assigned and managed by Azure. These identities are unique to the resource instance they are created for, and removed when the resource is deleted.

Rationale

The System Assigned Managed Identity is authenticated with Entra ID, and allows for privileges required for the instance of Azure Cache for Redis to be granted or restricted using Azure Role Based Access Control (RBAC). Additionally, the managed identity provides a means for the Azure Cache for Redis instance to authenticate without storing credentials in code.

Impact

No additional cost or performance impact is expected.

Audit Procedure

Audit From Azure Portal

  1. Search for and open the Azure Cache for Redis service
  2. For each instance, repeat the remaining steps
  3. Click on the name of the instance
  4. In the blade menu on the left, under Settings, click on Identity
  5. Under the System assigned tab, ensure that Status is set to On.

If Yes is selected and Object (principal) ID is populated, the configuration for that instance is compliant.

Expected Result

The System assigned managed identity Status should be set to On and an Object (principal) ID should be populated.

Remediation

Remediate From Azure Portal

  1. Search for and open the Azure Cache for Redis service
  2. For each instance, repeat the remaining steps
  3. Click on the name of the instance
  4. In the blade menu on the left, under Settings, click on Identity
  5. Under the System assigned tab, toggle the status to On
  6. Click the Save button
  7. In the pop-up dialog titled Enable system assigned managed identity that appears after clicking save, click the Yes button.

Default Value

By default, System Assigned Managed Identity of Off.

References

  1. https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-managed-identity

CIS Controls

Controls VersionControlIG 1IG 2IG 3
v85.5 Establish and Maintain an Inventory of Service AccountsXX