Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
storage_key_rotation_90_daysProvider: Azure
Service:
storageSeverity: MEDIUM
Categories:
secretsResource type:
microsoft.storage/storageaccountsWhat this check verifies
Azure Storage accounts must define akey expiration period for access-key rotation, with a maximum of 90 days. The evaluation looks for accounts lacking this setting or exceeding that limit.
Risk
Long-lived storage access keys undermine confidentiality and integrity: a leaked or reused key grants full data access and can sign SAS tokens. Extended validity enables persistent unauthorized access, data exfiltration, and tampering, and complicates revocation and incident response.Recommendation
Enforce akey expiration period of <= 90 days and automate rotation. Prefer Microsoft Entra ID with managed identities over Shared Key; when SAS is needed, use user-delegation SAS. Apply least privilege, minimize key distribution, monitor usage, rotate on suspected exposure, and disable Shared Key when feasible.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az storage account update —name <STORAGE_ACCOUNT_NAME> —resource-group <RESOURCE_GROUP_NAME> —key-exp-days 90
References
- https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal
- https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal#regenerate-storage-access-keys
- https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/StorageAccounts/regenerate-storage-account-access-keys-periodically.html#
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = storage_key_rotation_90_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks