rules/findings/azure/storage/azure-storage-account-key-rotation-reminder-disabled.json
|
{
"provider": "Azure", "serviceType": "Storage Accounts", "serviceName": "Storage", "displayName": "Ensure that \u0027Enable key rotation reminders\u0027 is enabled for each Storage Account", "description": "Access Keys authenticate application access requests to data contained in Storage Accounts. A periodic rotation of these keys is recommended to ensure that potentially compromised keys cannot result in a long-term exploitable credential. The \"Rotation Reminder\" is an automatic reminder feature for a manual procedure.", "rationale": "Reminders such as those generated by this recommendation will help maintain a regular and healthy cadence for activities which improve the overall efficacy of a security program.Cryptographic key rotation periods will vary depending on your organization\u0027s security requirements and the type of data which is being stored in the Storage Account. For example, PCI DSS mandates that cryptographic keys be replaced or rotated `regularly`, and advises that keys for static data stores be rotated every `few months`. For the purposes of this recommendation, 90 days will prescribed for the reminder. Review and adjustment of the 90 day period is recommended, and may even be necessary. Your organization\u0027s security requirements should dictate the appropriate setting.", "impact": "This recommendation only creates a periodic reminder to regenerate access keys. Regenerating access keys can affect services in Azure as well as the organization\u0027s applications that are dependent on the storage account. All clients that use the access key to access the storage account must be updated to use the new key.", "remediation": { "text": "###### From Azure Console\r\n\t\t\t\t\t1. Go to `Storage Accounts`\r\n\t\t\t\t\t2. For each Storage Account that is not compliant, go to `Access keys`\r\n\t\t\t\t\t3. Click `Set rotation reminder`\r\n\t\t\t\t\t4. Check the `Enable key rotation reminders`\r\n\t\t\t\t\t\r\n\t\t\t\t\tIn the Send reminders field select Custom, then set the Remind me every: field to `90` and the period drop down menu to Days.", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-privileged-access#pa-1-separate-and-limit-highly-privilegedadministrative-users", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-3-manage-application-identities-securely-and-automatically", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-6-define-and-implement-identity-and-privileged-access-strategy", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-8-restrict-the-exposure-of-credentials-and-secrets", "https://pcidssguide.com/pci-dss-key-rotation-requirements/", "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "9.3.1.1", "profile": [ "Level 1" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "az_storage_accounts", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "eq", "keys.keyPolicy.enableAutoRotation" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "name": "Name", "location": "Location", "ResourceGroupName": "ResourceGroupName", "keys.keyPolicy.enableAutoRotation": "Auto-Rotation Enabled", "keys.keyPolicy.keyExpirationPeriodInDays": "Reminder in Days" }, "expandObject": null }, "table": "default", "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "name", "location", "ResourceGroupName", "properties.keyPolicy.keyExpirationPeriodInDays" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "name": "Name", "location": "Location", "ResourceGroupName": "ResourceGroupName", "keys.keyPolicy.enableAutoRotation": "Auto-Rotation Enabled", "keys.keyPolicy.keyExpirationPeriodInDays": "Reminder in Days" }, "expandObject": null }, "status": { "keyName": ["name"], "message": "Ensure that \u0027Enable key rotation reminders\u0027 is enabled for {name}", "defaultMessage": "Ensure that \u0027Enable key rotation reminders\u0027 is enabled for each Storage Account" }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "AzureStorageAccount" }, "onlyStatus": false } }, "idSuffix": "storage_accounts_rotation_reminder_disabled", "notes": [ ], "categories": [ ], "immutable_properties": [ "id" ], "id": "azure_storage_007" } |