Policy: Azure > CIS v4.0 > 10 - Storage Services > 10.03 - Storage Accounts > 10.03.01 - Secrets and Keys > 10.03.01.03 - Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled'

Configures auditing against a CIS Benchmark item.

Level: 1

Storage account keys provide full access to storage account data. Disabling shared key access forces all requests to be authorized using Azure Active Directory (Azure AD), which provides more fine-grained access control and audit capabilities.

Disabling shared key access improves security by enforcing Azure AD authentication, enabling better access control through RBAC, and providing detailed audit logs of who accessed what data.

Primary Policy

This policy is used with the following primary policy:

Azure > CIS v4.0 > 10 - Storage Services > 10.03 - Storage Accounts > 10.03.01 - Secrets and Keys

Controls

Setting this policy configures this control:

Azure > CIS v4.0 > 10 - Storage Services > 10.03 - Storage Accounts > 10.03.01 - Secrets and Keys > 10.03.01.03 - Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled'

Policy Specification

Schema Type	`string`
Default	`Per Azure > CIS v4.0 > 10 - Storage Services > 10.03 - Storage Accounts > 10.03.01 - Secrets and Keys`
Valid Values [YAML]	`>- Per Azure > CIS v4.0 > 10 - Storage Services > 10.03 - Storage Accounts > 10.03.01 - Secrets and Keys` `Skip` `Check: Benchmark`

Schema Type

string

Default

Per Azure > CIS v4.0 > 10 - Storage Services > 10.03 - Storage Accounts > 10.03.01 - Secrets and Keys

Valid Values [YAML]

>-
  Per Azure > CIS v4.0 > 10 - Storage Services > 10.03 - Storage Accounts >
  10.03.01 - Secrets and Keys

Skip

Check: Benchmark

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/cis#/control/categories/v070503

Policy Type URI

tmod:@turbot/azure-cisv4-0#/policy/types/r10030103

GraphQL

query policyType(id: "tmod:@turbot/azure-cisv4-0#/policy/types/r10030103") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/azure-cisv4-0#/policy/types/r10030103'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/azure-cisv4-0#/policy/types/r10030103'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/azure-cisv4-0#/policy/types/r10030103"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/azure-cisv4-0#/policy/types/r10030103"