55 lines
2.3 KiB
YAML
55 lines
2.3 KiB
YAML
id: azure-blob-soft-delete-disabled
|
|
info:
|
|
name: Azure Blob Storage Soft Delete Not Enabled
|
|
author: princechaddha
|
|
severity: medium
|
|
description: |
|
|
Ensure that Soft Delete feature is enabled for all your Microsoft Azure Storage blob objects (blobs and snapshots). Soft Delete enables you to save and recover blob data in case your Azure Storage blobs or blob snapshots are deleted. This extra layer of protection also extends to the Microsoft Azure blob data that is erased as the result of an overwrite operation. With Soft Delete feature enabled, when blob objects are deleted, they are transitioned to a soft deleted state instead of being permanently erased. When blob objects are overwritten, soft deleted snapshots are created to save the state of the overwritten blob data.
|
|
impact: |
|
|
Not having Soft Delete enabled can lead to permanent loss of blob data which cannot be recovered, leading to potential data breaches and compliance issues.
|
|
remediation: |
|
|
Enable the Soft Delete feature for all blob storage accounts via the Azure Portal or using Azure CLI commands to ensure data is recoverable even after deletion or overwriting.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/storage/blobs/soft-delete-overview
|
|
tags: cloud,devops,azure,microsoft,blob-storage,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let storageAccount of iterate(template.storageAccountNames)) {
|
|
storageAccount = JSON.parse(storageAccount);
|
|
set("name", storageAccount.Name);
|
|
code(2);
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az storage account list --query '[*].{"Name":name}'
|
|
|
|
extractors:
|
|
- type: json
|
|
name: storageAccountNames
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az storage blob service-properties delete-policy show --account-name "$name" --output json --query 'enabled'
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- 'false'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- 'name + " blob storage does not have Soft Delete enabled"'
|
|
# digest: 490a0046304402200536e09710cb787d2f7cb12b51dc97b839699e83474fd744ecaf36d097095eee02205adf934a1ae03af7d012e2ad052f12bae7ca2ed41576b5f9b440316af978ca81:922c64590222798bb761d5b6d8e72950 |