Microsoft AzureOverview
Enable data encryption in transit.
Rationale
The secure transfer option enhances the security of a storage account by only allowing requests to the storage account by a secure connection. For example, when calling REST APIs to access storage accounts, the connection must use HTTPS. Any HTTP requests will be rejected when 'secure transfer required' is enabled. When using the Azure files service, connection without encryption will fail, including scenarios using SMB 2.1, SMB 3.0 without encryption, and some flavors of the Linux SMB client. Because Azure storage doesn't support HTTPS for custom domain names, this option is not applied when using a custom domain name.
Default Value
By default, Secure transfer required is enabled when you create a storage account.
References
- https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer
- https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security-overview
- https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-data-protection#dp-4-encrypt-sensitive-information-in-transit
Remediation guidance
Azure Remediation
Service-wide fix (recommended): keep secure transfer enabled on all storage accounts and treat any exception as a legacy compatibility case that needs a migration plan.
Azure portal
- Open the storage account.
- Go to
Configuration. - Set
Secure transfer requiredtoEnabled. - Save the change.
Azure CLI
az storage account update --name <storage-account-name> --resource-group <resource-group> --https-only true
Validate the setting:
az storage account show --name <storage-account-name> --resource-group <resource-group> --query enableHttpsTrafficOnly
Operational notes
- Secure transfer required is already the default for new storage accounts, so findings usually indicate drift or legacy deployments.
- Azure notes an important exception for NFS Azure Files scenarios that rely on network-level security. Treat those as exception cases, not the normal pattern.
- If applications still use plain HTTP or old SMB behavior, fix the client path instead of weakening the storage account.
References
- https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer
- https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security-overview
Query logic
These are the stored checks tied to this control.
Azure storage accounts not enforcing HTTPS
Connectors
Covered asset types
Expected check: eq []
{
storageAccounts(where: { NOT: { supportsHttpsTrafficOnly: true } }) {
...AssetFragment
}
}
