Azure storage account logging for queues is disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_33
Category - Subcategory	Logging - Disabled or missing
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

The Azure Queue Storage service stores messages that may be read by any client with access to the storage account. A queue may contain an unlimited number of messages, each of which can be up to 64KB in size when using version 2011-08-18 or newer. Storage Logging takes place server-side recording details in the storage account for both successful and failed requests. These logs allow users to see the details of read, write, and delete operations against the queues. Storage Logging log entries contain the following information about individual requests: timing information, for example start time, end-to-end latency, server latency, authentication details, concurrency information, and the size of request and response messages. Storage Analytics logs contain detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis. Storage Analytics logging is not enabled by default for your storage account.

How to Fix

Resource: azurerm_storage_account

• Arguments: logging + hour_metrics + minute_metrics

The logging field should be enough to enable logging. As Terraform apply might fail, it is recommended to also configure the hour_metrics and minute_metrics fields. [source,go]

resource "azurerm_storage_account" "example" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" queue_properties {

• logging { delete = true read = true write = true version = "1.0" retention_policy_days = 10 } } }

---

• hour_metrics { enabled = true include_apis = true version = "1.0" retention_policy_days = 10 }
• minute_metrics { enabled = true include_apis = true version = "1.0" retention_policy_days = 10 }

---