Benchmark: 10.3 Storage Accounts
Overview
This section covers security best practice recommendations for Storage Accounts in Azure.
The recommendations in this section apply to the Storage Account, but not to the Storage Services which may be running on that account. Use the Storage Account recommendations as a starting place for securing the account, then proceed to apply the recommendations from the storage services section(s) that are relevant to the storage services running on your account.
Storage Accounts are a family of account types that support different Storage Services. The Storage Account types and their supported services follow:
- Standard general-purpose v2 supported services: Blob Storage (including Data Lake Storage), Queue Storage, Table Storage, and Azure Files.
- Premium block blobs supported services: Blob Storage (including Data Lake Storage)
- Premium file shares supported services: Azure Files
- Premium page blobs supported services: Page blobs only
Help us improve this Benchmark! If you notice a needed correction, want to provide feedback, or wish to contribute security best practice guidance please join our community and create a ticket, propose a change, or start a discussion so we can improve this guidance!
The CIS Microsoft Azure Community is here: https://workbench.cisecurity.org/communities/72
Resources for Storage Accounts
Azure Product page:
Azure Storage Account overview:
Microsoft Cloud Security Baseline for Storage:
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-azure-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select 10.3 Storage Accounts.
Run this benchmark in your terminal:
powerpipe benchmark run azure_compliance.benchmark.cis_v400_10_3Snapshot and share results via Turbot Pipes:
powerpipe benchmark run azure_compliance.benchmark.cis_v400_10_3 --shareBenchmarks
Controls
- 10.3.4 Ensure that 'Secure transfer required' is set to 'Enabled'
- 10.3.5 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
- 10.3.6 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
- 10.3.7 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2'
- 10.3.8 Ensure 'Cross Tenant Replication' is not enabled
- 10.3.9 Ensure that 'Allow Blob Anonymous Access' is set to 'Disabled'
- 10.3.10 Ensure Azure Resource Manager Delete locks are applied to Azure Storage Accounts
- 10.3.11 Ensure Azure Resource Manager ReadOnly locks are considered for Azure Storage Accounts
- 10.3.12 Ensure Redundancy is set to 'geo-redundant storage (GRS)' on critical Azure Storage Accounts