azure.storage

Storage Account Resource

example:

Finds all Storage Accounts in the subscription.

policies:
    - name: find-all-storage-accounts
      resource: azure.storage

Filters

advisor-recommendation

blob-public-access

blob-services

cost

event

file-services

firewall-bypass

firewall-rules

list-item

management-policy-rules

marked-for-op

metric

offhour

onhour

policy-compliant

reduce

resource-lock

storage-diagnostic-settings

storage-metrics

value

advisor-recommendation

Filter resources by Azure Advisor Recommendations

Select all categories with ‘all’

example:

policies:
  - name: disks-with-cost-recommendations
    resource: azure.disk
    filters:
      - type: advisor-recommendation
        category: Cost
        key: '[].properties.recommendationTypeId'
        op: contains
        value: '48eda464-1485-4dcf-a674-d0905df5054a'

properties:
  category:
    type: string
  default:
    type: object
  key:
    type: string
  op:
    enum:
    - eq
    - equal
    - ne
    - not-equal
    - gt
    - greater-than
    - ge
    - gte
    - le
    - lte
    - lt
    - less-than
    - glob
    - regex
    - regex-case
    - in
    - ni
    - not-in
    - contains
    - difference
    - intersect
    - mod
  tag_key_transforms:
    items:
      type: string
    type: array
  type:
    enum:
    - advisor-recommendation
  value:
    oneOf:
    - type: array
    - type: string
    - type: boolean
    - type: number
    - type: 'null'
  value_from:
    additionalProperties: 'False'
    properties:
      expr:
        oneOf:
        - type: integer
        - type: string
      format:
        enum:
        - csv
        - json
        - txt
        - csv2dict
      headers:
        patternProperties:
          ? ''
          : type: string
        type: object
      query:
        type: string
      url:
        type: string
    required:
    - url
    type: object
  value_path:
    type: string
  value_regex:
    type: string
  value_type:
    enum:
    - age
    - integer
    - expiration
    - normalize
    - size
    - cidr
    - cidr_size
    - swap
    - resource_count
    - expr
    - unique_size
    - date
    - version
    - float
    - duration
required:
- category
- type

blob-public-access

Filter Storage Accounts by whether anonymous (public) blob access is allowed at the account level (the allowBlobPublicAccess property).

Azure does not always return allowBlobPublicAccess in the account properties. When it is absent the account permits anonymous access, so this filter treats a missing value as True (allowed). This makes it suitable for the CIS Microsoft Azure Foundations control “Ensure that ‘Allow Blob Anonymous Access’ is set to ‘Disabled’”, which a plain value filter would miss on accounts where the property is not present.

example:

Find all Storage Accounts that allow anonymous blob access (CIS 4.17), including those where the property is unset, and disable it.

policies:
    - name: cis-4-17-blob-anonymous-access
      resource: azure.storage
      filters:
        - type: blob-public-access
          value: true
      actions:
        - type: set-blob-public-access
          value: False

properties:
  type:
    enum:
    - blob-public-access
  value:
    default: true
    type: boolean
required:
- type

firewall-bypass

Filters resources by the firewall bypass rules.

example:

This policy will find all Storage Accounts with enabled Azure Services, Metrics and Logging bypass rules

policies:
  - name: storage-bypass
    resource: azure.storage
    filters:
      - type: firewall-bypass
        mode: equal
        list:
            - AzureServices
            - Metrics
            - Logging

properties:
  list:
    items:
      enum:
      - AzureServices
      - Metrics
      - Logging
    type: array
  mode:
    enum:
    - include
    - equal
    - any
    - only
  type:
    enum:
    - firewall-bypass
required:
- mode
- list
- type

Actions

auto-tag-date

auto-tag-user

delete

lock

logic-app

mark-for-op

notify

require-secure-transfer

set-blob-public-access

set-firewall-rules

set-log-settings

tag

tag-trim

untag

update

webhook

require-secure-transfer

Action that updates the Secure Transfer setting on Storage Accounts. Programmatically, this will be seen by updating the EnableHttpsTrafficOnly setting

example:: Turns on Secure transfer required for all storage accounts. This will reject requests that use HTTP to your storage accounts.

policies:
    - name: require-secure-transfer
      resource: azure.storage
      actions:
      - type: require-secure-transfer
        value: True

You can also set the minimum tls version on a bucket, valid values: TLS1_0, TLS1_1, TLS1_2:

policies:
    - name: require-secure-transfer-with-tls-v1-2
      resource: azure.storage
      actions:
      - type: require-secure-transfer
        value: True
        minimum_tls_version: TLS1_2

properties:
  minimum_tls_version:
    type: string
  type:
    enum:
    - require-secure-transfer
  value:
    default: true
    type: boolean
required:
- type

set-blob-public-access

Action that updates the allowBlobPublicAccess setting on Storage Accounts.

This is the account-level master switch for anonymous (public) blob access. When set to False, anonymous access is denied for all containers and blobs in the account regardless of an individual container’s publicAccess setting. This is the recommended remediation for CIS Microsoft Azure Foundations control “Ensure that ‘Allow Blob Anonymous Access’ is set to ‘Disabled’”.

To manage the public access level of an individual container instead, see the set-public-access action on the azure.storage-container resource.

example:

Disable anonymous blob access on all storage accounts that currently allow it, including accounts where allowBlobPublicAccess has never been set (Azure then allows anonymous access by default).

policies:
    - name: disable-blob-anonymous-access
      resource: azure.storage
      filters:
        - type: blob-public-access
          value: true
      actions:
        - type: set-blob-public-access
          value: False

properties:
  type:
    enum:
    - set-blob-public-access
  value:
    default: false
    type: boolean
required:
- type

set-firewall-rules

Set Firewall Rules Action

Updates Azure Storage Firewalls and Virtual Networks settings.

By default the firewall rules are appended with the new values. The append: False flag can be used to replace the old rules with the new ones on the resource.

You may also reference azure public cloud Service Tags by name in place of an IP address. Use ServiceTags. followed by the name of any group from https://www.microsoft.com/en-us/download/details.aspx?id=56519.

Note that there are firewall rule number limits and that you will likely need to use a regional block to fit within the limit. The limit for storage accounts is 200 rules.

- type: set-firewall-rules
      bypass-rules:
          - Logging
          - Metrics
      ip-rules:
          - 11.12.13.0/16
          - ServiceTags.AppService.CentralUS

example:

Find storage accounts without any firewall rules.

Configure default-action to Deny and then allow: - Azure Logging and Metrics services - Two specific IPs - Two subnets

policies:
    - name: add-storage-firewall
      resource: azure.storage

    filters:
        - type: value
          key: properties.networkAcls.ipRules
          value_type: size
          op: eq
          value: 0

    actions:
        - type: set-firewall-rules
          append: False
          bypass-rules:
              - Logging
              - Metrics
          ip-rules:
              - 11.12.13.0/16
              - 21.22.23.24
          virtual-network-rules:
              - <subnet_resource_id>
              - <subnet_resource_id>

properties:
  append:
    default: true
    type: boolean
  bypass-rules:
    items:
      enum:
      - AzureServices
      - Logging
      - Metrics
    type: array
  default-action:
    default: Deny
    enum:
    - Allow
    - Deny
  ip-rules:
    items:
      type: string
    type: array
  type:
    enum:
    - set-firewall-rules
  virtual-network-rules:
    items:
      type: string
    type: array
required:
- type

set-log-settings

Action that updates the logging settings on storage accounts. The action requires specifying an array of storage types that will be impacted by the action (blob, queue, table), retention (number in days; 0-365), and an array of log settings to enable (read, write, delete). The action will disable any settings not listed (e.g. by providing log: [write, delete], the action will disable read).

example:: Enable write and delete logging and disable read logging on blob storage, and retain logs for 5 days.

policies:
    - name: enable-blob-storage-logging
      resource: azure.storage
      actions:
        - type: set-log-settings
          storage-types: [blob]
          retention: 5
          log: [write, delete]

properties:
  log:
    items:
      enum:
      - read
      - write
      - delete
      type: string
    type: array
  retention:
    type: number
  storage-types:
    items:
      enum:
      - blob
      - queue
      - table
      type: string
    type: array
  type:
    enum:
    - set-log-settings
required:
- storage-types
- log
- retention
- type

update

Update scalar storage account settings.

example:

Default to Microsoft Entra authorization in the Azure portal for accounts where the setting is absent or false:

policies:
  - name: storage-default-to-entra-authorization
    resource: azure.storage
    filters:
      - or:
          - properties.defaultToOAuthAuthentication: absent
          - properties.defaultToOAuthAuthentication: false
    actions:
      - type: update
        properties:
          defaultToOAuthAuthentication: true

Property names follow the Azure REST API. Only supplied properties are updated. Setting allowedCopyScope to null clears that restriction. Changing the portal default does not disable Shared Key authorization.

Enabling isSftpEnabled requires hierarchical namespace to be enabled on the account and incurs SFTP charges while enabled.

properties:
  properties:
    additionalProperties: false
    minProperties: 1
    properties:
      accessTier:
        enum:
        - Hot
        - Cool
        - Cold
      allowBlobPublicAccess:
        type: boolean
      allowCrossTenantReplication:
        type: boolean
      allowSharedKeyAccess:
        type: boolean
      allowedCopyScope:
        enum:
        - AAD
        - PrivateLink
        - null
      defaultToOAuthAuthentication:
        type: boolean
      isLocalUserEnabled:
        type: boolean
      isSftpEnabled:
        type: boolean
      minimumTlsVersion:
        enum:
        - TLS1_0
        - TLS1_1
        - TLS1_2
      publicNetworkAccess:
        enum:
        - Enabled
        - Disabled
        - SecuredByPerimeter
      supportsHttpsTrafficOnly:
        type: boolean
    type: object
  type:
    enum:
    - update
required:
- properties
- type

Permissions - Microsoft.Storage/storageAccounts/write