Ensure 'Enable key rotation reminders' is enabled for each Storage Account

Overview

Access Keys authenticate application access requests to data contained in Storage Accounts. A periodic rotation of these keys is recommended to ensure that potentially compromised keys cannot result in a long-term exploitable credential. The "Rotation Reminder" is an automatic reminder feature for a manual procedure.

Rationale

Reminders such as those generated by this recommendation will help maintain a regular and healthy cadence for activities that improve the overall efficacy of a security program.

Cryptographic key rotation periods will vary depending on your organization's security requirements and the type of data being stored in the Storage Account. For example, PCI DSS mandates that cryptographic keys be replaced or rotated 'regularly' and advises that keys for static data stores be rotated every 'few months.'

For the purposes of this recommendation, 90 days will be prescribed for the reminder. Review and adjustment of the 90-day period is recommended and may even be necessary. Your organization's security requirements should dictate the appropriate setting.

Impact

This recommendation only creates a periodic reminder to regenerate access keys. Regenerating access keys can affect services in Azure and the organization's applications that are dependent on the storage account. All clients that use the access key to access the storage account must be updated to use the new key.

Default Value

By default, Key rotation reminders are not configured.

Remediation guidance

Azure Portal

Open the storage account in the Azure Portal using the Open in Azure button.
Click Set rotation reminder.
Check Enable key rotation reminders.
In the Send reminders field, select Custom, then set the Remind me every field to 90 and the period drop-down to Days.
Click Save.

PowerShell

$rgName  = <resource group name for the storage>
$accountName  = <storage_account_name>
$account  =  Get-AzStorageAccount  -ResourceGroupName  $rgName  -Name  $accountName

if ($account.KeyCreationTime.Key1  -eq  $null  -or  $account.KeyCreationTime.Key2
-eq  $null) {
Write-output ("You must regenerate both keys at least once before
setting expiration policy")
} else {
$account  =  Set-AzStorageAccount  -ResourceGroupName  $rgName  -Name
$accountName  -KeyExpirationPeriodInDay  90
}

$account.KeyPolicy.KeyExpirationPeriodInDays

Multiple Remediation Paths

Azure

SERVICE-WIDE (RECOMMENDED when many resources are affected): Assign Azure Policy initiatives at management group/subscription scope and trigger remediation tasks.

az policy assignment create --name <assignment-name> --scope /subscriptions/<subscription-id> --policy-set-definition <initiative-id>
az policy remediation create --name <remediation-name> --policy-assignment <assignment-id>

ASSET-LEVEL: Apply the resource-specific remediation steps above to the listed non-compliant resources.

PREVENTIVE: Embed Azure Policy checks into landing zones and IaC workflows to block or auto-remediate drift.

References for Service-Wide Patterns

Azure Policy overview: https://learn.microsoft.com/en-us/azure/governance/policy/overview
Azure Policy remediation: https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources
Azure Policy initiative structure: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/initiative-definition-structure

Operational Rollout Workflow

Use this sequence to reduce risk and avoid repeated drift.

1. Contain at Service-Wide Scope First (Recommended)

Azure: assign policy initiatives at management group/subscription scope and run remediation tasks.

az policy assignment create --name <assignment-name> --scope /subscriptions/<subscription-id> --policy-set-definition <initiative-id>
az policy remediation create --name <remediation-name> --policy-assignment <assignment-id>

2. Remediate Existing Affected Assets

Execute the control-specific Console/CLI steps documented above for each flagged resource.
Prioritize internet-exposed and production assets first.

3. Validate and Prevent Recurrence

Re-scan after each remediation batch.
Track exceptions with owner and expiry date.
Add preventive checks in IaC/CI pipelines.

Query logic

These are the stored checks tied to this control.

Azure Storage Accounts Without Key Rotation Reminders

Connectors

Microsoft Azure

Covered asset types

StorageAccount

Expected check: eq []

{
  storageAccounts(where: { keyExpirationPeriodInDays: 0 }) {
    ...AssetFragment
  }
}