Azure Storage account soft delete is disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_38
Category - Subcategory	Storage - Backups
Provider	AZURE
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	854edc33-62b4-46c0-83a1-2774ae9ae4ff

Impact

This rule is checking to see if the soft-delete feature is enabled on Azure storage accounts. It's important to have soft-delete enabled because it provides a safeguard against accidental deletion of data. It keeps deleted data available for recovery for a certain period, preventing any loss due to human error, programmatic errors, or malicious activities. Without this feature, deleted data is irretrievable, potentially causing data loss which can have severe consequences for businesses.

How to Fix

Resource: azurerm_storage_account

• Arguments: blob_properties.delete_retention_policy.days, blob_properties.delete_retention_policy, account_kind

To fix this issue, you need to enable the soft-delete option in the configuration of your Azure storage account.

In the resource block "azurerm_storage_account", the sub-block "blob_properties" contains a "delete_retention_policy" block. This block contains an attribute called days. When you set a number for this attribute, it specifies the number of days the deleted blobs should be retained in the Storage account. In the example above, it is set to 7 days. If the value of "days" is set to 0, soft delete is disabled for the Azure Storage account.

By enabling soft-delete, this gives you the opportunity to restore the blob data when it is accidentally deleted. It is a layer of protection that can serve as a backup. This increases the security of your data stored on Azure. [source,go]

resource "azurerm_storage_account" "example" { name = "examplestoracc" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS"

blob_properties { delete_retention_policy { days = 7 } } }