Control: Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
Description
The Azure Storage blobs contain data like ePHI or Financial, which can be secret or personal.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.storage_account_blob_and_container_soft_delete_enabled
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.storage_account_blob_and_container_soft_delete_enabled --share
SQL
This control uses a named query:
select sa.id as resource, case when blob_soft_delete_enabled and blob_container_soft_delete_enabled and blob_soft_delete_retention_days between 7 and 365 and blob_container_soft_delete_retention_days between 7 and 365 then 'ok' else 'alarm' end as status, case when blob_soft_delete_enabled and blob_container_soft_delete_enabled and blob_soft_delete_retention_days between 7 and 365 and blob_container_soft_delete_retention_days between 7 and 365 then sa.name || ' soft delete is enabled for azure containers and blob storage with retention days: blob=' || blob_soft_delete_retention_days || ', container=' || blob_container_soft_delete_retention_days || '.' when (not blob_soft_delete_enabled or blob_soft_delete_enabled is null) and (not blob_container_soft_delete_enabled or blob_container_soft_delete_enabled is null) then sa.name || ' blob and azure container soft delete disabled.' when (not blob_soft_delete_enabled or blob_soft_delete_enabled is null) then sa.name || ' blob soft delete disabled.' when (not blob_container_soft_delete_enabled or blob_container_soft_delete_enabled is null) then sa.name || ' azure container soft delete disabled.' when blob_soft_delete_retention_days < 7 or blob_soft_delete_retention_days > 365 then sa.name || ' blob soft delete retention days (' || blob_soft_delete_retention_days::text || ') is not between 7 and 365 days.' when blob_container_soft_delete_retention_days < 7 or blob_container_soft_delete_retention_days > 365 then sa.name || ' azure container soft delete retention days (' || blob_container_soft_delete_retention_days::text || ') is not between 7 and 365 days.' end as reason , sa.resource_group as resource_group , sub.display_name as subscriptionfrom azure_storage_account sa, azure_subscription subwhere sub.subscription_id = sa.subscription_id;