Detection: Storage Account Lifecycle Policy Updated
Overview
Detect when a lifecycle management policy for an Azure Storage account was updated. Lifecycle policies automate data tiering, retention, and deletion, and unauthorized or unintended changes to these policies can lead to data loss, increased costs, or non-compliance with data retention requirements. Monitoring these updates ensures proper data management and adherence to organizational policies.
References:
Usage
Run the detection in your terminal:
powerpipe detection run azure_activity_log_detections.detection.storage_account_lifecycle_policy_updatedSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run azure_activity_log_detections.detection.storage_account_lifecycle_policy_updated --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,operation_name as operation,resource_id as resource,caller as actor,tp_index::varchar as subscription_id,resource_group_name as resource_group,tp_id as source_id,status as event_status,*
from azure_activity_logwhere operation_name = 'Microsoft.Storage/storageAccounts/managementPolicies/write' and status = 'Succeeded'
order by timestamp desc;