rules/findings/azure/storage/azure-storage-account-access-key-rotation-disabled.json
|
{
"provider": "Azure", "serviceType": "Storage Accounts", "serviceName": "Storage", "displayName": "Ensure that storage account access keys are periodically regenerated", "description": "For increased security, regenerate storage account access keys periodically.", "rationale": "When a storage account is created, Azure generates two 512-bit storage access keys which are used for authentication when the storage account is accessed. Rotating these keys periodically ensures that any inadvertent access or exposure does not result from the compromise of these keys.\r\nCryptographic key rotation periods will vary depending on your organization's security requirements and the type of data which is being stored in the Storage Account. For example, PCI DSS mandates that cryptographic keys be replaced or rotated 'regularly,' and advises that keys for static data stores be rotated every `few months.`\r\nFor the purposes of this recommendation, _ARG_0_ days will be prescribed for the reminder. Review and adjustment of the _ARG_0_ day period is recommended, and may even be necessary. Your organization's security requirements should dictate the appropriate setting.", "impact": "Regenerating access keys can affect services in Azure as well as the organization\u0027s applications that are dependent on the storage account. All clients that use the access key to access the storage account must be updated to use the new key.", "remediation": { "text": "Follow Microsoft Azure documentation for regenerating storage account access keys.", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-privileged-access#pa-1-separate-and-limit-highly-privilegedadministrative-users", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-2-protect-identity-and-authentication-systems", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-6-define-and-implement-identity-and-privileged-access-strategy", "https://pcidssguide.com/pci-dss-key-rotation-requirements/", "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "9.3.1.2", "profile": [ "Level 1" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "az_storage_accounts", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "keys.keyRotation.key1.lastRotatedInDays", "eq", "_ARG_0_" ], [ "keys.keyRotation.key2.lastRotatedInDays", "eq", "_ARG_0_" ] ], "operator": "or" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "name": "Name", "location": "Location", "ResourceGroupName": "ResourceGroupName", "keys.keyRotation.key1.keyCreationTime": "Key1 Creation Time", "keys.keyRotation.key2.keyCreationTime": "Key2 Creation Time" }, "expandObject": null }, "table": "default", "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "name", "location", "ResourceGroupName", "keys" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "name": "Name", "location": "Location", "ResourceGroupName": "ResourceGroupName", "keys.keyRotation.key1.keyCreationTime": "Key1 Creation Time", "keys.keyRotation.key2.keyCreationTime": "Key2 Creation Time" }, "expandObject": null }, "status": { "keyName": ["name"], "message": "Ensure that storage account access keys are periodically regenerated for {name}", "defaultMessage": "Ensure that storage account access keys are periodically regenerated" }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "AzureStorageAccount" }, "onlyStatus": false } }, "idSuffix": "storage_accounts_missing_key_rotation", "notes": [ ], "categories": [ ], "immutable_properties": [ "id" ], "id": "azure_storage_008" } |