Azure Storage Services Benchmark
64 articles
- Ensure 'Allowed Protocols' for Shared Access Signature (SAS) Tokens Are Restricted to HTTPS Only for Secrets and Keys
- Ensure that shared access signature (SAS) tokens expire within an hour for Secrets and Keys
- Ensure stored access policies (SAP) are used when generating shared access signature (SAS) tokens
- Ensure Critical Data is Encrypted with Microsoft Managed Keys (MMK)
- Ensure 'Versioning' is set to 'Enabled' on Azure Blob Storage storage accounts
- Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- Ensure locked immutability policies are used for containers storing business-critical blob data
- Ensure double encryption is used for Azure Data Box in high-security environments
- Ensure Public Network Access is Disabled
- Ensure Network Access Rules are Set to Deny-by-Default
- Ensure 'Public network access' is set to 'Disabled' on Azure Elastic SAN
- Ensure Private Endpoints Are Used to Access {service}
- Ensure 'Key Encryption Key' Is Set to a Customer-Managed Key for Azure Managed Lustre File Systems
- Ensure Soft Delete on Backup Vaults is Enabled
- Ensure Soft Delete for Blobs on Azure Blob Storage Accounts Is Enabled
- Ensure Immutability for Backup Vaults is Enabled
- Ensure Backup Data in Backup Vaults Is Encrypted Using Customer-Managed Keys (CMK)
- Ensure 'Use infrastructure encryption for this vault' is Enabled on Backup Vaults
- Ensure 'Cross Region Restore' is Set to 'Enabled' on Backup Vaults
- Ensure 'Encryption Key Source' Is Set to 'Customer Managed Key' for Azure NetApp Files Accounts
- Ensure 'Cross Subscription Restore' is Set to 'Disabled' or 'Permanently Disabled' on Backup Vaults
- Ensure 'SMB Channel Encryption' Is Set to 'AES-256-GCM' or Higher for SMB File Shares
- Ensure Customer-Managed Keys (CMK) Are Used to Encrypt Data at Rest on Azure Elastic SAN Volume Groups
- Ensure That 'Enable Key Rotation Reminders' Is Enabled for Each Storage Account
- Ensure Storage Explorer Is Using the Latest Version
- Ensure Redundancy Is Set to 'Geo-Redundant Storage (GRS)' on Critical Azure Storage Accounts
- Ensure Azure Resource Manager ReadOnly Locks Are Considered for Azure Storage Accounts
- Ensure Azure Resource Manager Delete Locks Are Applied to Azure Storage Accounts
- Ensure Soft Delete on Recovery Services Vaults is Enabled
- Ensure Immutability for Recovery Services Vaults is Enabled
- Ensure Backup Data in Recovery Services Vaults Is Encrypted Using Customer-Managed Keys (CMK)
- Ensure Use Infrastructure Encryption for This Vault Is Enabled on Recovery Services Vaults
- Ensure Public Network Access on Recovery Services Vaults is Disabled
- Ensure Cross Region Restore Is Set to Enabled on Recovery Services Vaults
- Ensure 'Cross Subscription Restore' Is Set to 'Disabled' or 'Permanently Disabled' on Recovery Services Vaults
- Ensure Soft Delete for Azure File Shares is Enabled
- Ensure Root Squash for NFS File Shares Is Configured
- Ensure 'SMB Protocol Version' Is Set to 'SMB 3.1.1' or Higher for SMB File Shares
- Ensure That 'Allow Blob Anonymous Access' Is Set to 'Disabled
- Ensure 'Allowed Protocols' for SAS Tokens Are Restricted to HTTPS Only for Azure Blob Storage
- Ensure that shared access signature (SAS) tokens expire within an hour for Azure Blob Storage
- Ensure Cross Tenant Replication is Disabled for Azure Storage Accounts
- Ensure stored access policies (SAP) are used when generating shared access signature (SAS) tokens for Azure Blob Storage
- Ensure 'Allowed Protocols' for SAS Tokens Are Restricted to HTTPS Only for Azure Queue Storage
- Ensure the 'Minimum TLS Version' for Storage Accounts Is Set to 'Version 1.2
- Ensure Storage Logging Is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests
- Ensure that shared access signature (SAS) tokens expire within an hour for Queue Storage
- Ensure stored access policies (SAP) are used when generating shared access signature (SAS) tokens for Queue Storage
- Ensure 'Allowed Protocols' for Shared Access Signature (SAS) Tokens Are Restricted to HTTPS Only for Azure Storage Services
- Ensure Storage Logging Is Enabled for Blob Service for 'Read', 'Write', and 'Delete' Requests
- Ensure that shared access signature (SAS) tokens expire within an hour for Storage Explorer
- Ensure stored access policies (SAP) are used when generating shared access signature (SAS) tokens for Storage Explorer
- Ensure Storage Logging Is Enabled for Queue Service for 'Read', 'Write', and 'Delete' Requests
- Ensure Soft Delete Is Enabled for Azure Containers and Blob Storage
- Ensure 'Allow Azure Services on the Trusted Services List to Access This Storage Account' Is Enabled for Storage Account Access
- Ensure That ‘Enable Infrastructure Encryption’ for Each Storage Account in Azure Storage Is Set to ‘Enabled’
- Ensure ‘Secure Transfer Required’ is Enabled for Azure Storage Accounts
- Ensure That Storage Account Access Keys Are Periodically Regenerated
- Ensure that shared access signature (SAS) tokens expire within an hour for Storage Accounts
- Ensure 'Allow Storage Account Key Access' for Azure Storage Accounts Is 'Disabled'
- Ensure Storage for Critical Data Is Encrypted with Customer Managed Keys (CMK)
- Ensure Private Endpoints Are Used to Access Storage Accounts
- Ensure That 'Public Network Access' Is 'Disabled' for Storage Accounts
- Ensure Default Network Access Rule for Storage Accounts Is Set to Deny