Control: 3.2 Ensure that storage account access keys are periodically regenerated
Regenerate storage account access keys periodically.
When a storage account is created, Azure generates two 512-bit storage access keys, which are used for authentication when the storage account is accessed. Rotating these keys periodically ensures that any inadvertent access or exposure does not result in these keys being compromised.
- Login to Azure Storage Accounts
- For each selected storage account, go to
Activitylog from side bar
- Under Timespan drop-down, select Custom and choose Start time and End time such that it ranges 90 days
RegenerateKeyin the Search text box
- Click Apply
- It should list out all RegenerateKey events. If no such event exists, then this is a finding.
To remediate, follow Microsoft Azure documentation for regenerating storage account access keys.
Note: By default, access keys are not regenerated periodically.
steampipe check azure_compliance.control.cis_v130_3_2
This control uses a named query:manual_control