Skip to main content

🛡️ Azure Storage Account Access Keys are not regenerated periodically🟢⚪

  • Contextual name: 🛡️ Access Keys are not regenerated periodically🟢⚪
  • ID: /ce/ca/azure/storage/access-keys-regenerated-periodically
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Similar Policies​

Description​

Open File

Description​

For increased security, regenerate storage account access keys periodically.

Rationale​

When a storage account is created, Azure generates two 512-bit storage access keys which are used for authentication when the storage account is accessed. Rotating these keys periodically ensures that any inadvertent access or exposure does not result from the compromise of these keys.

Cryptographic key rotation periods will vary depending on your organization's security requirements and the type of data which is being stored in the Storage Account. For example, PCI DSS mandates that cryptographic keys be replaced or rotated 'regularly,' and advises that keys for static data stores be rotated every 'few months.'

For the purposes of this recommendation, 90 days will prescribed for the reminder. Review and adjustment of the 90 day period is recommended, and may even be necessary. Your organization's security requirements should dictate the appropriate setting.

Impact​

Regenerating access keys can affect services in Azure as well as the organization's applications that are dependent on the storage account. All clients who use the access key to access the storage account must be updated to use the new key.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Go to Storage Accounts.
  2. For each Storage Account with outdated keys, under Security + networking, go to Access keys.
  3. Click Rotate key next to the outdated key, then click Yes to the prompt confirming that you want to regenerate the access key.

After Azure regenerates the Access Key, you can confirm that Access keys reflects a Last rotated date of (0 days ago).

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS Azure v2.1.0 → 💼 3.4 Ensure that Storage Account Access Keys are Periodically Regenerated - Level 1 (Manual)1no data
💼 CIS Azure v3.0.0 → 💼 4.4 Ensure that Storage Account Access Keys are Periodically Regenerated (Manual)1no data
💼 CIS Azure v4.0.0 → 💼 10.3.1.2 Ensure that Storage Account access keys are periodically regenerated (Manual)1no data
💼 Cloudaware Framework → 💼 Secure Access57no data