Detection: Storage Account Key Regenerated
Overview
Detect when an access key for an Azure Storage account was regenerated. Regenerating storage account keys can impact applications and services relying on the old key, potentially causing downtime or unauthorized access if the new key is not securely distributed. Monitoring these events ensures operational continuity and strengthens security by detecting unauthorized or unplanned changes.
References:
Usage
Run the detection in your terminal:
powerpipe detection run azure_activity_log_detections.detection.storage_account_key_regeneratedSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run azure_activity_log_detections.detection.storage_account_key_regenerated --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,operation_name as operation,resource_id as resource,caller as actor,tp_index::varchar as subscription_id,resource_group_name as resource_group,tp_id as source_id,status as event_status,*
from azure_activity_logwhere operation_name = 'Microsoft.Storage/storageAccounts/regenerateKey/action' and status = 'Succeeded'
order by timestamp desc;