Updating considerations

Author: netapp-manishc

articles/azure-netapp-files/object-rest-api-introduction.md

@@ -21,6 +21,11 @@ This mapping is accomplished by presenting a specified NAS directory hierarchy a
 * Object REST API buckets are associated with volumes. Deleting the volume associated with a bucket permanently deletes the bucket. This action can't be undone. 
 * Buckets are supported with cool access-enabled volumes and with large volumes. 
 * You are responsible for maintaining the lifecycle of your bucket certificates. To check the expiration and renew certificates view the **Bucket** menu then check the **Certificate** status and **Certificate expiration date** fields. 
+* You must enable diagnostic logging on all Azure Key Vaults to ensure audit trails are available for security investigations.
+* You must configure network access control lists (ACLs) to restrict Key Vault access to only authorized networks (NetApp VNet and customer VNet).
+* You must implement separate Azure Key Vaults for certificates (read-only access) and S3 credentials (write access) to adhere to the principle of least privilege.
+* You must store Azure Key Vaults object references for certificates and credentials in separate buckets to maintain proper access control boundaries.
+
 
 ## Supported actions