> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/azure/az_get_keys.md).

# AZ\_GET\_KEYS

## Summary

|                            |                                                                                                                                                                       |
| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **FSProtect ACL Alias**    | AZ\_GET\_KEYS                                                                                                                                                         |
| **Azure Alias**            | Get Keys (Key Vault Data Plane)                                                                                                                                       |
| **Affected Object Types**  | Key Vaults                                                                                                                                                            |
| **Exploitation Certainty** | Certain                                                                                                                                                               |
| **Permission**             | Key Vault data-plane permission `keys/get` - either via Key Vault access policy or Azure RBAC role **Key Vault Crypto User** (`12338af0-0e69-4776-bea7-57ae8d297424`) |

## Description

`AZ_GET_KEYS` represents the ability to **read keys** from an Azure Key Vault. This is a data-plane permission that allows retrieval of cryptographic keys stored in the vault.

Key Vault keys are used for:

* **Data encryption/decryption** (Azure Disk Encryption, Storage Service Encryption, SQL TDE).
* **Signing and verification** of tokens, documents, and code.
* **Wrapping and unwrapping** other keys (key encryption keys).
* **Authentication** via certificate-backed keys.

A principal with this permission can read key material, which depending on the key type and configuration may enable:

* Decryption of protected data.
* Forging signed tokens or documents.
* Impersonation of services that use the key for authentication.

> **Note:** For HSM-protected keys, the private key material cannot be exported, but operations (sign, decrypt) can still be performed if the principal also has `keys/sign` or `keys/decrypt` permissions.

## Identification

### PowerShell (Az Module)

```powershell
Connect-AzAccount

# Check access policies on a vault (vault access policy model)
$vault = Get-AzKeyVault -VaultName "<VaultName>"
$vault.AccessPolicies | Where-Object { $_.PermissionsToKeys -match "get|list|all" } |
    Select-Object DisplayName, ObjectId, PermissionsToKeys |
    Format-Table -AutoSize

# Check RBAC assignments (RBAC access model)
Get-AzRoleAssignment -Scope $vault.ResourceId |
    Where-Object { $_.RoleDefinitionName -in "Key Vault Crypto User", "Key Vault Crypto Officer", "Key Vault Administrator" } |
    Select-Object DisplayName, RoleDefinitionName, ObjectType |
    Format-Table -AutoSize
```

### Azure Portal

1. Open **Azure Portal** -> navigate to the target **Key Vault**.
2. Go to **Access policies** -> review policies that include **Get** under **Key permissions**.
3. Alternatively, go to **Access control (IAM)** -> review assignments for **Key Vault Crypto User** or higher roles.

## Exploitation

### Step 1 - Grant Yourself Key Access (as Key Vault Contributor)

```powershell
Connect-AzAccount

# Grant yourself key get/list permissions via access policy
Set-AzKeyVaultAccessPolicy -VaultName "<VaultName>" `
    -ObjectId "<YourObjectId>" `
    -PermissionsToKeys get,list
```

### Step 2 - Read All Keys

```powershell
Connect-AzAccount

# List all keys in the vault
$keys = Get-AzKeyVaultKey -VaultName "<VaultName>"

# Read each key
$keys | ForEach-Object {
    $key = Get-AzKeyVaultKey -VaultName "<VaultName>" -Name $_.Name
    [PSCustomObject]@{
        Name    = $_.Name
        KeyType = $key.KeyType
        KeySize = $key.KeySize
        Created = $key.Created
        Updated = $key.Updated
        Enabled = $key.Enabled
    }
} | Format-Table -AutoSize
```

![Read Key Vault keys with PowerShell](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-ff32c3f884fc3e56c6630f3d7620ed94e300643b%2Fazure-az_get_keys-image-1.png?alt=media)

### Via PowerZure

* Get-AzureKeyVaultContent
* Export-AzureKeyVaultContent

## Mitigation

1. **Restrict key access policies**
   * Go to **Azure Portal** -> target Key Vault -> **Access policies**.
   * Remove `get` permission from any principal that does not need to read keys.
   * Use the principle of least privilege.
2. **Use HSM-protected keys**
   * For the most sensitive keys, use HSM-backed keys that prevent key material export.
3. **Switch to Azure RBAC model**
   * Use granular RBAC roles like **Key Vault Crypto User** instead of broad access policies.
4. **Enable diagnostic logging**
   * Go to Key Vault -> **Diagnostic settings** -> enable **AuditEvent** logging.

## Detection

Use the Azure Portal:

1. Open **Azure Portal** -> target **Key Vault**.
2. Open **Monitoring** -> **Metrics** and review key operation activity for unusual spikes in `KeyGet`, `KeyList`, sign, or decrypt operations.
3. Open **Activity log** and review management-plane changes to access policies, role assignments, or vault configuration around the same timeframe.
4. Open **Diagnostic settings** and confirm **AuditEvent** logging is enabled for future investigations.
5. Open **Access control (IAM)** and **Access policies** to review identities with key read or cryptographic permissions.

## References

* <https://learn.microsoft.com/en-us/azure/key-vault/keys/about-keys>
* <https://blog.netspi.com/azure-automation-accounts-key-stores/>
* <https://powerzure.readthedocs.io/en/latest/Functions/operational.html#get-azurekeyvaultcontent>