62 lines
2.8 KiB
YAML
62 lines
2.8 KiB
YAML
id: azure-blob-immutable-not-enabled
|
|
info:
|
|
name: Azure Blob Immutable Storage Not Enabled
|
|
author: princechaddha
|
|
severity: high
|
|
description: |
|
|
Ensure that Immutable Blob Storage feature is enabled for Microsoft Azure Storage blob containers that hold sensitive and business-critical information. Immutable Blob Storage enables you to store critical, production data objects in a WORM (Write Once, Read Many) state. This state makes the data non-erasable and non-modifiable for a user-specified time interval. Azure blob objects can be created and read, but not modified or deleted, for the duration of the retention interval configured. The feature supports two types of policies that you can apply to a container for retaining the data within the specified container in a non-modifiable and delete-protected state.
|
|
impact: |
|
|
Failure to enable Immutable Blob Storage can result in critical data being modified or deleted, which could lead to regulatory compliance issues and potential data loss.
|
|
remediation: |
|
|
Apply an appropriate time-based immutability policy or a legal hold policy to your Azure Storage blob containers to protect sensitive and business-critical data from being modified or deleted.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-storage
|
|
tags: cloud,devops,azure,microsoft,azure-blob-storage,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let AccountData of iterate(template.accountList)) {
|
|
AccountData = JSON.parse(AccountData);
|
|
set("name", AccountData.Name);
|
|
code(2);
|
|
let containerList = template.code_2_response;
|
|
let ContainerData = JSON.parse(containerList);
|
|
ContainerData.forEach(container => {
|
|
set("currentContainer", JSON.stringify(container));
|
|
javascript(1);
|
|
});
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az storage account list --query '[*].{"Name":name}'
|
|
|
|
extractors:
|
|
- type: json
|
|
name: accountList
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az storage container list --account-name "$name" --query '[*].{"ContainerName":name, "TimeBasedRetentionPolicy":properties.hasImmutabilityPolicy, "LegalHoldPolicy": properties.hasLegalHold}'
|
|
|
|
javascript:
|
|
- code: |
|
|
let container = JSON.parse(template.currentContainer);
|
|
if (!container.TimeBasedRetentionPolicy && !container.LegalHoldPolicy) {
|
|
let result = `Blob container '${container.ContainerName}' in account '${template.name}' does not have Immutable Blob Storage enabled.`;
|
|
Export(result);
|
|
}
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- response
|
|
# digest: 490a0046304402202f47bb9c98de7e67b628e99ed6429cf57c274bd314a383ffbd01ad4c1275ab82022054631aa9a4a8925752d47c9ada309e4c7c228416b5afeecf186ed555f956c9e8:922c64590222798bb761d5b6d8e72950 |