Ensure Azure Resource Manager Delete Locks are Applied to Azure Storage Accounts

高レベル 1手動レビューazure

説明

Azure Resource Manager CannotDelete (Delete) locks can prevent users from accidentally or maliciously deleting a storage account. This feature ensures that while the Storage account can still be modified or used, deletion of the Storage account resource requires removal of the lock by a user with appropriate permissions. This feature is a protective control for the availability of data. By ensuring that a storage account or its parent resource group cannot be deleted without first removing the lock, the risk of data loss is reduced. While an automated assessment procedure exists for this recommendation, the assessment status remains manual. Determining storage accounts that require CannotDelete locks depends on the context and requirements of each organization and environment. Applying a Delete lock on storage accounts protects the availability of data by preventing the accidental or...

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Audit from Azure Portal 1. Navigate to the storage account in the Azure portal. 2. For each storage account, under Settings, click Locks. 3. Ensure that a Delete lock exists on the storage account. Audit from Azure CLI az lock list --resource-group <resource-group> \ --resource-name <storage-account> \ --resource-type "Microsoft.Storage/storageAccounts" Audit from PowerShell Get-AzResourceLock -ResourceGroupName <RESOURCEGROUPNAME> ` -ResourceName <STORAGEACCOUNTNAME> ` -ResourceType "Microsoft.Storage/storageAccounts" Audit from Azure Policy There is currently no built-in Microsoft policy to audit resource locks on storage accounts. Custom and community policy definitions can check for the existence of a “Microsoft.Authorization/locks” resource with an AuditIfNotExists effect.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Remediate from Azure Portal 1. Navigate to the storage account in the Azure portal. 2. Under the Settings section, select Locks. 3. Select Add. 4. Provide a Name, and choose Delete for the type of lock. 5. Add a note about the lock if desired. Remediate from Azure CLI Replace the information within <> with appropriate values: az lock create --name <lock> \ --resource-group <resource-group> \ --resource <storage-account> \ --lock-type CanNotDelete \ --resource-type Microsoft.Storage/storageAccounts Remediate from PowerShell Replace the information within <> with appropriate values: New-AzResourceLock -LockLevel CanNotDelete ` -LockName <lock> ` -ResourceName <storage-account> ` -ResourceType Microsoft.Storage/storageAccounts ` -ResourceGroupName <resource-group>

プロパティ

オペレーティングシステム: すべて
タグ: azurecloud
参照: CIS Microsoft Azure Foundations Benchmark v6.0.0 - 9.3.9 Ensure Azure Resource Manager Delete Locks are Applied to Azure Storage Accounts