Microsoft AzureOverview
For increased security, regenerate storage account access keys periodically.
Rationale
When a storage account is created, Azure generates two 512-bit storage access keys, which are used for authentication when the storage account is accessed. Rotating these keys periodically ensures that any inadvertent access or exposure does not result in the compromise of the keys.
Cryptographic key rotation periods will vary depending on your organization's security requirements and the type of data being stored in the Storage Account. For example, PCI DSS mandates that cryptographic keys be replaced or rotated 'regularly' and advises that keys for static data stores be rotated every 'few months.'
For the purposes of this recommendation, 90 days will be prescribed for the reminder. Review and adjustment of the 90-day period is recommended and may even be necessary. Your organization's security requirements should dictate the appropriate setting.
Impact
Regenerating access keys can affect Azure services and the organization's applications dependent on the storage account. All clients that use the access key to access the storage account must be updated to use the new key.
Default Value
By default, access keys are not regenerated periodically.
Remediation guidance
Azure Portal
- Open the storage account in the Azure Portal using the
Open in Azurebutton. - Click
Rotate keynext to the outdated key, then clickYesto the prompt confirming that you want to regenerate the access key.
After Azure regenerates the Access Key, you can confirm that Access keys reflects a Last rotated date of (0 days ago).
Azure CLI
- Update the connection strings in your application to reference the secondary access key for the storage account.
- Call the az storage account keys renew command to regenerate the primary access key, as shown in the following example:
az storage account keys renew \
--resource-group <resource-group> \
--account-name <storage-account> \
--key primary
- Update the connection strings in your application to reference the new primary access key.
- Regenerate the secondary access key in the same manner. To regenerate the secondary key, use
secondaryas the key name instead ofprimary.
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Storage account access keys are periodically regenerated
Connectors
Covered asset types
Expected check: eq []
{StorageAccountsWithOldKeys{...AssetFragment}}
