rules/findings/azure/storage/azure-storage-account-geo-redundancy-storage-not-set.json
|
{
"provider": "Azure", "serviceType": "Storage Accounts", "serviceName": "Storage", "displayName": "Ensure Redundancy is set to \u0027geo-redundant storage (GRS)\u0027 on critical Azure Storage Accounts", "description": "Geo-redundant storage (GRS) in Azure replicates data three times within the primary region using locally redundant storage (LRS) and asynchronously copies it to a secondary region hundreds of miles away. This setup ensures high availability and resilience by providing 16 nines (99.99999999999999%) durability over a year, safeguarding data against regional outages.", "rationale": "Enabling GRS protects critical data from regional failures by maintaining a copy in a geographically separate location. This significantly reduces the risk of data loss, supports business continuity, and meets high availability requirements for disaster recovery.", "impact": "Enabling geo-redundant storage on Azure storage accounts increases costs due to cross-region data replication.", "remediation": { "text": "Remediate from Azure Portal 1. Go to Storage accounts. 2. Click on a storage account. 3. Under Data management, click Redundancy. 4. From the Redundancy drop-down menu, select Geo-redundant storage (GRS). 5. Click Save. 6. Repeat steps 1-5 for each storage account requiring remediation. Remediate from Azure CLI For each storage account requiring remediation, run the following command to enable geo-redundant storage:", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy2", "https://learn.microsoft.com/en-us/azure/storage/common/redundancy-migration", "https://learn.microsoft.com/en-us/cli/azure/storage/account?view=azure-clilatest#az-storage-account-update", "https://learn.microsoft.com/en-us/powershell/module/az.storage/setazstorageaccount", "https://learn.microsoft.com/en-us/azure/storage/common/storage-disasterrecovery-guidance" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "9.3.11", "profile": [ "Level 2" ] } ], "level": "info", "tags": [], "rule": { "path": "az_storage_accounts", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [ [ "skuName", "match", "^(?!Standard_(GRS|GZRS|RAGRS|RAGZRS)$)" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "name": "Name", "location": "Location", "resourceGroupName": "ResourceGroupName", "skuName": "SKU" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "id", "skuName", "name", "properties", "locks" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "name": "Name", "location": "Location", "resourceGroupName": "ResourceGroupName", "skuName": "SKU" }, "expandObject": null }, "status": { "keyName": [ "name" ], "message": "Ensure Redundancy is set to \u0027geo-redundant storage (GRS)\u0027 for {name} Storage Account", "defaultMessage": "Ensure Redundancy is set to \u0027geo-redundant storage (GRS)\u0027 on critical Azure Storage Accounts" }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "AzureStorageAccount" }, "onlyStatus": false } }, "idSuffix": "storage_accounts_geo_redundancy_not_set", "notes": [], "categories": [], "immutableProperties": [ "id" ], "id": "azure_storage_021" } |