[RULE] AZ-KV-003: Key Vault without diagnostic logging enabled #26

What to build

A scan rule that detects Azure Key Vaults with no diagnostic
logging configured. Without logging, access to secrets, keys,
and certificates is not recorded, making it impossible to detect
unauthorised access or investigate a breach involving key material.

Rule details

• Rule ID: AZ-KV-003
• Severity: MEDIUM
• Category: Key Vault
• Frameworks: CIS 8.4, NIST DE.CM-7, ISO 27001 A.12.4.1

Files to create

• scanner/rules/az_kv_003.py
• playbooks/cli/fix_az_kv_003.sh

Technical note

Use azure-mgmt-monitor to check diagnostic settings.
Call client.diagnostic_settings.list(resource_uri) where
resource_uri is the full Key Vault resource ID.
A vault with no diagnostic settings or with all logs disabled
should be flagged.

How to get started

1. Read CONTRIBUTING.md
2. Fork the repo, create branch feat/az-kv-003
3. Write the rule and playbook
4. Open a PR to dev

Acceptance Criteria

• Rule follows template exactly
• Returns correct findings JSON
• Playbook tested
• Framework mappings included in all three compliance files