Storage account has secure transfer required enabled

Check ID: storage_secure_transfer_required_is_enabled
Provider: Azure
Service: storage
Severity: HIGH
Categories: encryption
Resource type: microsoft.storage/storageaccounts

What this check verifies

Azure Storage accounts are evaluated for secure transfer enforcement, requiring all client requests to use HTTPS only (enableHttpsTrafficOnly) and blocking HTTP.

Risk

Allowing HTTP to storage endpoints enables man-in-the-middle and TLS-stripping attacks. Intercepted traffic can expose credentials, SAS tokens, or data (confidentiality) and allow request tampering (integrity), leading to unauthorized access and data exfiltration.

Recommendation

Enforce HTTPS-only on all storage accounts (enableHttpsTrafficOnly) and use modern TLS. Apply least privilege to SAS and keys, rotate if exposure is suspected, and use defense in depth: prefer private endpoints, restrict public access, block HTTP at network controls, and ensure all clients use https:// endpoints.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az storage account update -g <RESOURCE_GROUP> -n <STORAGE_ACCOUNT_NAME> —https-only true

# Enable secure transfer (HTTPS only) on a Storage Account
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<location>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  enable_https_traffic_only = true # Critical: require HTTPS-only (secure transfer)
}

// Enable secure transfer (HTTPS only) on a Storage Account
resource <example_resource_name> 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  sku: { name: 'Standard_LRS' }
  kind: 'StorageV2'
  properties: {
    supportsHttpsTrafficOnly: true // Critical: require HTTPS-only (secure transfer)
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = storage_secure_transfer_required_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Storage account key expiration is 90 days or less Storage account uses AES-256-GCM for SMB encryption

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires