🛡️ Azure Storage classic logging has no bounded retention🟢

• Contextual name: 🛡️ Classic logging has no bounded retention🟢
• ID: /ce/ca/azure/storage/classic-logging-without-retention
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: COST

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Storage Account
  • 🔌 Azure Storage Account - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Ensure that every Azure Storage Blob, Queue, or Table service with classic Storage Analytics logging enabled has an enabled, positive retention period. The policy does not prescribe a maximum number of retention days.

Rationale

Classic Storage Analytics logging records service requests in the storage account. Without retention, those logs can accumulate indefinitely and increase storage costs. Setting a bounded retention period keeps the logging needed for operations and investigations while limiting unplanned growth.

Impact

When the retention period expires, Azure permanently deletes the corresponding classic log records. Before reducing or enabling retention, confirm audit, security-investigation, legal-hold, backup, and recovery requirements. Export logs to an appropriate destination if they must be retained for longer.

Audit

This policy marks an Azure Storage Account as INCOMPLIANT when at least one classic Blob, Queue, or Table logging operation is enabled and the matching service has retention disabled or a retention period of zero days or fewer.

... see more

Remediation

Open File

Remediation

Review the retention requirement

1. Identify every Blob, Queue, and Table service with classic logging enabled.
2. Confirm the retention period required for audit, security, legal-hold, backup, and recovery obligations.
3. Export records that must outlive the selected period before enabling retention.

Configure retention from Azure CLI

First inspect the current configuration for each affected service. Use b, q, or t for the Blob, Queue, or Table service respectively:

az storage logging show \
    --account-name {{storage-account-name}} \
    --services {{b|q|t}} \
    --account-key {{storage-account-key}}

Set a positive retention period. Replace {{enabled-operations}} with the currently enabled combination of r, w, and d so the command preserves the required logging scope:

az storage logging update \
    --account-name {{storage-account-name}} \
    --services {{b|q|t}} \
    --log {{enabled-operations}} \
    --retention {{retention-days}} \
    --account-key {{storage-account-key}}

... [see more](remediation.md)

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 Cloudaware Framework → 💼 Resource Optimization			37		no data