Policy Packs

guardrails-samples

This section covers security recommendations to follow to set storage account policies on an Azure Subscription. An Azure storage account provides a unique namespace to store and access Azure Storage data objects.

Azure CIS v2.0.0 - Section 3 - Storage Accounts

main

azure_storage_storage_account_access_keys_rotation_reminder

Configure the access keys rotation reminder settings required for `Azure &gt; Storage &gt; Storage Account`.&#92;n&#92;nEnabling rotation reminder on a Storage Account will ensure that access keys can be rotated regularly and maintain high security.&#92;n

storageAccountAccessKeysRotationReminder

Azure > Storage > Storage Account > Access Keys > Rotation Reminder

azure_storage_storage_account_access_keys_rotation_reminder_days

Rotation reminder period in days for the Storage Account.&#92;n

storageAccountAccessKeysRotationReminderDays

Azure > Storage > Storage Account > Access Keys > Rotation Reminder > Days

azure_storage_storage_account_approved

Determine the action to take when an Azure Storage storage account is not approved based on `Azure &gt; Storage &gt; Storage Account &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

storageAccountApproved

Azure > Storage > Storage Account > Approved

azure_storage_storage_account_approved_infrastructure_encryption

Determine whether the Azure Storage storage account is allowed to have a Infrastructure Encryption enabled.&#92;n&#92;nThis policy will be evaluated by the Approved control. If an Azure Storage Storage Account is not approved, it will be subject to the action specified in the `Azure &gt; Storage &gt; Storage Account &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

storageAccountApprovedInfrastructureEncryption

Azure > Storage > Storage Account > Approved > Infrastructure Encryption

azure_storage_storage_account_blob_logging

Determine the action when Azure Storage Account logging for blob service is not configured based on Azure &gt; Storage &gt; Storage Account &gt; Blob &gt; Logging &gt; * policies.&#92;n&#92;nThe logging control checks if logging is configured correctly for the blob service. If the resource is not configured according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n

storageAccountBlobLogging

Azure > Storage > Storage Account > Blob > Logging

azure_storage_storage_account_blob_logging_properties

Defines the Blob Service Properties for a Storage Account that can be used to enable logging for Blob Services.

storageAccountBlobLoggingProperties

Azure > Storage > Storage Account > Blob > Logging > Properties

azure_storage_storage_account_blob_logging_retention_days

Defines the the number of days that metrics or logging or soft-deleted data should be retained.&#92;n**Note:** Number of days neither should be less than 0 nor greater than 365.&#92;n

storageAccountBlobLoggingRetentionDays

Azure > Storage > Storage Account > Blob > Logging > Retention Days

azure_storage_storage_account_blob_public_access

Define the Public Access settings required for `Azure &gt; Storage &gt; Storage Account`.&#92;n&#92;nThe Public Access policy determines whether the public access for Azure Storage Account should be Enabled or Disabled.&#92;n&#92;nEnabling public access on a storage account, permits to configure container ACLs to allow anonymous access to blobs within the storage account.&#92;n

storageAccountPublicAccess

Azure > Storage > Storage Account > Blob Public Access

azure_storage_storage_account_data_protection_soft_delete

Configure the data protection soft delete settings required for `Azure &gt; Storage &gt; Storage Account`.&#92;n&#92;nSoft delete provides an additional layer of data protection which allows to recover data that has been accidentally deleted or overwritten.&#92;n

storageAccountDataProtectionSoftDelete

Azure > Storage > Storage Account > Data Protection > Soft Delete

azure_storage_storage_account_encryption_in_transit

Configured whether Azure Storage storage account Encryption in Transit is enabled.

storageAccountEncryptionInTransit

Azure > Storage > Storage Account > Encryption in Transit

azure_storage_storage_account_minimum_tls_version

Define the Minimum TLS Version setting required for `Azure &gt; Storage &gt; Storage Account`.&#92;n

storageAccountMinimumTlsVersion

Azure > Storage > Storage Account > Minimum TLS Version

azure_storage_storage_account_queue_service_logging

Determine the action when Azure Storage Account logging for queue service is not configured based on Azure &gt; Storage &gt; Storage Account &gt; Queue &gt; Logging &gt; * policies.&#92;n&#92;nThe logging control checks if logging is configured correctly for the queue service. If the resource is not configured according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n

queueServiceLogging

Azure > Storage > Storage Account > Queue > Logging

azure_storage_storage_account_queue_service_logging_properties

Defines the Queue Service Properties for a Storage Account that can be used to enable logging for Queue Services. This policy provides a default for Queue Service Properties in Azure Storage Account, however you can explicitly override the setting.

queueServiceLoggingProperties

Azure > Storage > Storage Account > Queue > Logging > Properties

azure_storage_storage_account_queue_service_logging_properties_retention_days

Defines the the number of days that metrics or logging or soft-deleted data should be retained.&#92;n&#92;n_Note_: `Number of days neither should be less than 0 nor greater than 365.`&#92;n

queueServiceLoggingPropertiesRetentionDays

Azure > Storage > Storage Account > Queue > Logging > Properties > Retention Days

azure_storage_storage_account_soft_delete_blobs

Determine whether to enable or disable soft delete settings for blobs for the Azure Blob Storage for `Azure &gt; Storage &gt; Storage Account`.&#92;n

storageAccountDataProtectionSoftDeleteBlobs

Azure > Storage > Storage Account > Data Protection > Soft Delete > Blobs

azure_storage_storage_account_soft_delete_blobs_retention_days

Configure blob retention duration in days. The retention days varies from 1 to 365 days where 7 is the default value.&#92;n

storageAccountDataProtectionSoftDeleteBlobsRetentionDays

Azure > Storage > Storage Account > Data Protection > Soft Delete > Blobs > Retention Days

azure_storage_storage_account_soft_delete_containers

Determine whether to enable or disable soft delete settings for containers for the Azure Containers for `Azure &gt; Storage &gt; Storage Account`.&#92;n

storageAccountDataProtectionSoftDeleteContainers

Azure > Storage > Storage Account > Data Protection > Soft Delete > Containers

azure_storage_storage_account_soft_delete_containers_retention_days

Configure container retention duration in days. The retention days varies from 1 to 365 days where 7 is the default value.&#92;n

storageAccountDataProtectionSoftDeleteContainersRetentionDays

Azure > Storage > Storage Account > Data Protection > Soft Delete > Containers > Retention Days

turbot_policy_setting.azure_storage_storage_account_access_keys_rotation_reminder

turbot_policy_setting.azure_storage_storage_account_access_keys_rotation_reminder_days

turbot_policy_setting.azure_storage_storage_account_approved

turbot_policy_setting.azure_storage_storage_account_approved_infrastructure_encryption

turbot_policy_setting.azure_storage_storage_account_blob_logging

turbot_policy_setting.azure_storage_storage_account_blob_logging_properties

turbot_policy_setting.azure_storage_storage_account_blob_logging_retention_days

turbot_policy_setting.azure_storage_storage_account_blob_public_access

turbot_policy_setting.azure_storage_storage_account_data_protection_soft_delete

turbot_policy_setting.azure_storage_storage_account_soft_delete_blobs

turbot_policy_setting.azure_storage_storage_account_soft_delete_blobs_retention_days

turbot_policy_setting.azure_storage_storage_account_soft_delete_containers

turbot_policy_setting.azure_storage_storage_account_soft_delete_containers_retention_days

turbot_policy_setting.azure_storage_storage_account_encryption_in_transit

turbot_policy_setting.azure_storage_storage_account_minimum_tls_version

turbot_policy_setting.azure_storage_storage_account_queue_service_logging

turbot_policy_setting.azure_storage_storage_account_queue_service_logging_properties

turbot_policy_setting.azure_storage_storage_account_queue_service_logging_properties_retention_days

Policy	Setting	Note
Azure > Storage > Storage Account > Access Keys > Rotation Reminder	Check: Enabled per Rotation Reminder > Days	Azure CIS v2.0.0 - Control: 3.3
Azure > Storage > Storage Account > Access Keys > Rotation Reminder > Days	90	Azure CIS v2.0.0 - Control: 3.3
Azure > Storage > Storage Account > Approved	Check: Approved	Azure CIS v2.0.0 - Control: 3.2
Azure > Storage > Storage Account > Approved > Infrastructure Encryption	Approved if enabled	Azure CIS v2.0.0 - Control: 3.2
Azure > Storage > Storage Account > Blob > Logging	Check: Per `Logging > *`	Azure CIS v2.0.0 - Control: 3.13
Azure > Storage > Storage Account > Blob > Logging > Properties	- "Read" - "Write" - "Delete"	Azure CIS v2.0.0 - Control: 3.13
Azure > Storage > Storage Account > Blob > Logging > Retention Days	7	Azure CIS v2.0.0 - Control: 3.13
Azure > Storage > Storage Account > Blob Public Access	Check: Disabled	Azure CIS v2.0.0 - Control: 3.7
Azure > Storage > Storage Account > Data Protection > Soft Delete	Check: Configured per Soft Delete > * policies	Azure CIS v2.0.0 - Control: 3.11
Azure > Storage > Storage Account > Data Protection > Soft Delete > Blobs	Enabled	Azure CIS v2.0.0 - Control: 3.11
Azure > Storage > Storage Account > Data Protection > Soft Delete > Blobs > Retention Days	7	Azure CIS v2.0.0 - Control: 3.11
Azure > Storage > Storage Account > Data Protection > Soft Delete > Containers	Enabled	Azure CIS v2.0.0 - Control: 3.11
Azure > Storage > Storage Account > Data Protection > Soft Delete > Containers > Retention Days	7	Azure CIS v2.0.0 - Control: 3.11
Azure > Storage > Storage Account > Encryption in Transit	Check: Enabled	Azure CIS v2.0.0 - Control: 3.1
Azure > Storage > Storage Account > Minimum TLS Version	Check: TLS 1.2	Azure CIS v2.0.0 - Control: 3.15
Azure > Storage > Storage Account > Queue > Logging	Check: Per Logging > Properties	Azure CIS v2.0.0 - Control: 3.5
Azure > Storage > Storage Account > Queue > Logging > Properties	- "Read" - "Write" - "Delete"	Azure CIS v2.0.0 - Control: 3.5
Azure > Storage > Storage Account > Queue > Logging > Properties > Retention Days	7	Azure CIS v2.0.0 - Control: 3.5

Policy Settings