Control: 10.3.12 Ensure Redundancy is set to 'geo-redundant storage (GRS)' on critical Azure Storage Accounts

Description

Geo-redundant storage (GRS) in Azure replicates data three times within the primary region using locally redundant storage (LRS) and asynchronously copies it to a secondary region hundreds of miles away. This setup ensures high availability and resilience by providing 16 nines (99.99999999999999%) durability over a year, safeguarding data against regional outages.

Enabling GRS protects critical data from regional failures by maintaining a copy in a geographically separate location. This significantly reduces the risk of data loss, supports business continuity, and meets high availability requirements for disaster recovery.

Remediation

From Azure Portal

Go to Storage accounts.
Click on a storage account.
Under Data management, click Redundancy.
From the Redundancy drop-down menu, select Geo-redundant storage (GRS).
Click Save.
Repeat steps 1-5 for each storage account requiring remediation.

From Azure CLI

For each storage account requiring remediation, run the following command to enable geo-redundant storage:

az storage account update --resource-group <resource-group> --name <storage-account> --sku Standard_GRS

From PowerShell

For each storage account requiring remediation, run the following command to enable geo-redundant storage:

Set-AzStorageAccount -ResourceGroupName <resource-group> -Name <storage-account> -SkuName "Standard_GRS"

Default Value

When creating a storage account in the Azure Portal, the default redundancy setting is geo-redundant storage (GRS). Using the Azure CLI, the default is read-access geo-redundant storage (RA-GRS). In PowerShell, a redundancy level must be explicitly specified during account creation.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v400_10_3_12

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v400_10_3_12 --share

SQL

This control uses a named query:

select
  s.id as resource,
  case
    when sku_name = any(ARRAY ['Standard_GRS', 'Standard_RAGRS', 'Standard_GZRS', 'Standard_RAGZRS']) then 'ok'
    else 'alarm'
  end as status,
  case
    when sku_name = any(ARRAY ['Standard_GRS', 'Standard_RAGRS', 'Standard_GZRS', 'Standard_RAGZRS']) then name || ' geo-redundant enabled.'
    else name || ' geo-redundant disabled.'
  end as reason
  
  , s.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_storage_account as s,
  azure_subscription as sub
where
  sub.subscription_id = s.subscription_id;