Ensure stored access policies (SAP) are used when generating shared access signature (SAS) tokens

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

It is not currently possible to retrieve a list of all generated SAS tokens to check if they were associated with a SAP during creation. An SAS token that has been created with a SAP will contain an si parameter that references the stored access policy identifier associated with the SAS, e.g. si=<stored-access-policy-identifier>. The si parameter will be absent from an SAS token created without a SAP.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Remediate from Azure Portal To create a SAP for a queue: 1. Go to Storage accounts. 2. Click on a storage account. 3. Under Data storage, click Queues. 4. Click the name of a queue. 5. Under Settings, click Access policy. 6. Under Stored access policies, click + Add policy. 7. Enter an Identifier. 8. From the Permissions drop-down, select appropriate permissions for the policy. 9. Set an appropriate Start time for the policy. 10. Set an appropriate Expiry time for the policy. 11. Click OK. 12. Click Save. 13. Repeat steps 1-12 as needed to create SAP. When generating SAS, select a SAP from the Stored access policy drop-down. If SAS have been created without a SAP, the SAS can be revoked by regenerating the storage account access keys: Note: Regenerating access keys can affect any applications or Azure services that are dependent on the storage account key. 1. Go to Storage accounts. 2. Click on a storage account. 3. Under Security + networking, click Access keys. 4. Next to each key, click Rotate key. 5. Click Yes to confirm. 6. Repeat steps 1-5 as needed to revoke SAS.