Microsoft AzureOverview
Access Keys authenticate application access requests to data contained in Storage Accounts. A periodic rotation of these keys is recommended to ensure that potentially compromised keys cannot result in a long-term exploitable credential. The "Rotation Reminder" is an automatic reminder feature for a manual procedure.
Rationale
Reminders such as those generated by this recommendation will help maintain a regular and healthy cadence for activities that improve the overall efficacy of a security program.
Cryptographic key rotation periods will vary depending on your organization's security requirements and the type of data being stored in the Storage Account. For example, PCI DSS mandates that cryptographic keys be replaced or rotated 'regularly' and advises that keys for static data stores be rotated every 'few months.'
For the purposes of this recommendation, 90 days will be prescribed for the reminder. Review and adjustment of the 90-day period is recommended and may even be necessary. Your organization's security requirements should dictate the appropriate setting.
Impact
This recommendation only creates a periodic reminder to regenerate access keys. Regenerating access keys can affect services in Azure and the organization's applications that are dependent on the storage account. All clients that use the access key to access the storage account must be updated to use the new key.
Default Value
By default, Key rotation reminders are not configured.
Remediation guidance
Azure Portal
- Open the storage account in the Azure Portal using the
Open in Azurebutton. - Click
Set rotation reminder. - Check
Enable key rotation reminders. - In the
Send remindersfield, selectCustom, then set theRemind me everyfield to90and the period drop-down toDays. - Click
Save.
PowerShell
$rgName = <resource group name for the storage>
$accountName = <storage_account_name>
$account = Get-AzStorageAccount -ResourceGroupName $rgName -Name $accountName
if ($account.KeyCreationTime.Key1 -eq $null -or $account.KeyCreationTime.Key2
-eq $null) {
Write-output ("You must regenerate both keys at least once before
setting expiration policy")
} else {
$account = Set-AzStorageAccount -ResourceGroupName $rgName -Name
$accountName -KeyExpirationPeriodInDay 90
}
$account.KeyPolicy.KeyExpirationPeriodInDays
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Azure Storage Accounts Without Key Rotation Reminders
Connectors
Covered asset types
Expected check: eq []
{
storageAccounts(where: { keyExpirationPeriodInDays: 0 }) {
...AssetFragment
}
}
