🛡️ Azure Storage Account Blob Service Versioning is not enabled🟢
- Contextual name: 🛡️ Blob Service Versioning is not enabled🟢
- ID:
/ce/ca/azure/storage/blob-versioning
- Tags:
- Policy Type:
BEST_PRACTICE
- Policy Categories:
RELIABILITY
Logic
Description
Description
Enabling blob versioning allows for the automatic retention of previous versions of objects. With blob versioning enabled, earlier versions of a blob are accessible for data recovery in the event of modifications or deletions.
Rationale
Blob versioning safeguards data integrity and enables recovery by retaining previous versions of stored objects, facilitating quick restoration from accidental deletion, modification, or malicious activity.
Impact
Enabling blob versioning for a storage account creates a new version with each write operation to a blob, which can increase storage costs. To control these costs, a lifecycle management policy can be applied to automatically delete older versions.
Audit
This policy flags an Azure Storage Account as
INCOMPLIANT
ifBlob Versioning
is set to Disabled.Default Value
Blob versioning is disabled by default on storage accounts.
References
- https://learn.microsoft.com/en-us/cli/azure/storage/account
- https://learn.microsoft.com/en-us/cli/azure/storage/account/blob-service-properties
... see more
Remediation
Remediation
From Azure Portal
- Go to
Storage accounts
.- Click the name of a storage account with blob storage.
- In the
Overview
page, on theProperties
tab, underBlob service
, clickDisabled
next toVersioning
.- Under
Tracking
, check the box next toEnable versioning for blobs
.- Select the radio button next to
Keep all versions or Delete versions after (in days)
.- If selecting to delete versions, enter a number of in the box after which to delete blob versions.
- Click
Save
.- Repeat steps 1-7 for each storage account with blob storage.
From Azure CLI
For each storage account requiring remediation, run the following command to enable blob versioning:
az storage account blob-service-properties update --account-name <storage-account> --enable-versioning true
From PowerShell
For each storage account requiring remediation, run the following command to enable blob versioning:
Update-AzStorageBlobServiceProperty -ResourceGroupName <resource-group> -StorageAccountName <storage-account> -IsVersioningEnabled $true
... [see more](remediation.md)
policy.yaml
Linked Framework Sections
Section | Sub Sections | Internal Rules | Policies | Flags | Compliance |
---|---|---|---|---|---|
💼 CIS Azure v4.0.0 → 💼 10.2.2 Ensure 'Versioning' is set to 'Enabled' on Azure Blob Storage storage accounts (Automated) | 1 | no data | |||
💼 Cloudaware Framework → 💼 Data Protection and Recovery | 16 | no data |