How to block IPs trying to hit Key Vaults?


I have an alert - Mass secret retrieval from Azure Key Vault - for an external IP that is trying to access out key vaults over and over. When I check the Azure Key Vault Security workbook and look under the 'Analytics over Key Vault events' tab and then go to Event Analysis > Failed events > Activity by Caller IP, I see this IP at the top of the list basically launching continuous key vault requests.


How do I go about blocking this IP?



3 Replies
best response confirmed by Jeff Walzer (Contributor)
Have you enabled firewall for key vault it's not enabled by default
Ref the below article

@Chandrasekhar_Arya - Thx again for the reply and info as I needed to allow access only from selected networks

@Chandrasekhar_Arya - what if I have a key vault that is part of a resource group that has no VNET defined (just an RG with app services) so I can't select the 'Selected networks' option under the Firewalls and virtual networks blade to choose it's local VNET/subnet?

What network should I look to select for a scenario like this?