Skip to main content

🛡️ Azure Storage Account Access Key Rotation Reminders are not enabled🟢

Logic​

Similar Policies​

  • Internal: dec-x-b6d97943

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-b6d979431

Description​

Open File

Description​

Access Keys authenticate application access requests to data contained in Storage Accounts. A periodic rotation of these keys is recommended to ensure that potentially compromised keys cannot result in a long-term exploitable credential. The "Rotation Reminder" is an automatic reminder feature for a manual procedure.

Rationale​

Reminders such as those generated by this recommendation will help maintain a regular and healthy cadence for activities which improve the overall efficacy of a security program.

Cryptographic key rotation periods will vary depending on your organization's security requirements and the type of data which is being stored in the Storage Account. For example, PCI DSS mandates that cryptographic keys be replaced or rotated 'regularly', and advises that keys for static data stores be rotated every 'few months'.

For the purposes of this recommendation, 90 days will prescribed for the reminder. Review and adjustment of the 90 day period is recommended, and may even be necessary. Your organization's security requirements should dictate the appropriate setting.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Go to Storage Accounts.
  2. For each Storage Account that is not compliant, under Security + networking, go to Access keys.
  3. Click Set rotation reminder.
  4. Check Enable key rotation reminders.
  5. In the Send reminders field select Custom, then set the Remind me every field to 90 and the period drop down to Days.
  6. Click Save.

From Powershell​

$rgName = {{resource-group-name}}
$accountName = {{storage-account-name}}

### Get storage account details
$account = Get-AzStorageAccount `
    -ResourceGroupName $rgName `
    -Name $accountName

### Check if both keys have been regenerated at least once
if ($account.KeyCreationTime.Key1 -eq $null -or $account.KeyCreationTime.Key2 -eq $null) {
    Write-Output "You must regenerate both keys at least once before setting expiration policy"
}
else {
    # Set key expiration policy to 90 days
    $account = Set-AzStorageAccount `
        -ResourceGroupName $rgName `
        -Name $accountName `
        -KeyExpirationPeriodInDay 90
}

### Display the key expiration period

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 44c loss of, or unauthorised access to, encryption keys safeguarding extremely critical or sensitive information assets.810no data
💼 CIS Azure v5.0.0 → 💼 9.3.1.1 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account (Automated)1no data
💼 Cloudaware Framework → 💼 Secure Access70no data