Ensure stored access policies (SAP) are used when generating shared access signature (SAS) tokens

ÉlevéeNiveau 1Revue manuelleazure

Description

Use stored access policies (SAP) when generating shared access signature (SAS) tokens in Azure to centrally manage permissions, expiration, and revocation settings for resource access. Stored access policies can be applied to blob containers, file shares, queues, and tables. Stored access policies provide centralized control over SAS token access, allowing administrators to update permissions or revoke access. This approach strengthens security by reducing the risk of unauthorized access to storage resources.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

It is not currently possible to retrieve a list of all generated SAS tokens to check if they were associated with a SAP during creation. An SAS token that has been created with a SAP will contain an si parameter that references the stored access policy identifier associated with the SAS, e.g. si=<stored-access-policy-identifier>. The si parameter will be absent from an SAS token created without a SAP.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Remediate from Azure Portal To create a SAP for a queue: 1. Go to Storage accounts. 2. Click on a storage account. 3. Under Data storage, click Queues. 4. Click the name of a queue. 5. Under Settings, click Access policy. 6. Under Stored access policies, click + Add policy. 7. Enter an Identifier. 8. From the Permissions drop-down, select appropriate permissions for the policy. 9. Set an appropriate Start time for the policy. 10. Set an appropriate Expiry time for the policy. 11. Click OK. 12. Click Save. 13. Repeat steps 1-12 as needed to create SAP. When generating SAS, select a SAP from the Stored access policy drop-down. If SAS have been created without a SAP, the SAS can be revoked by regenerating the storage account access keys: Note: Regenerating access keys can affect any applications or Azure services that are dependent on the storage account key. 1. Go to Storage accounts. 2. Click on a storage account. 3. Under Security + networking, click Access keys. 4. Next to each key, click Rotate key. 5. Click Yes to confirm. 6. Repeat steps 1-5 as needed to revoke SAS.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: access-controlauthazurecloudstorage
Référence: CIS Microsoft Azure Storage Services Benchmark v2.0.0 - 15.3 Ensure stored access policies (SAP) are used when generating shared access signature (SAS) tokens