CCSS (Common Configuration Scoring System) is a set of measures used to determine the severity of the rule.
Each rule is associated with a high-level category. For example IAM, Container, Monitoring, Logging, Network, etc.
Is your environment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CC-00691
- creditSnyk Research Team
Description
Although storage accounts are encrypted by default with Microsoft-managed keys, customer-managed keys allow users to choose when to rotate their keys per compliance and security requirements, and provide users with a means to prevent Azure from accessing their data by disabling keys.
How to fix?
Set the encryption.keySource attribute in Microsoft.Storage/storageAccounts resource to Microsoft.Keyvault, set the encryption.keyvaultproperties.keyvaulturi attribute in Microsoft.Storage/storageAccounts resource to the valid keyvaulturi.
Example configuration:
{
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Storage/storageAccounts",
"apiVersion": "2022-09-01",
"name": "allowedstorage691",
"location": "[resourceGroup().location]",
"sku": {
"name": "Standard_GRS"
},
"identity": {
"type": "SystemAssigned"
},
"kind": "Storage"
},
{
"type": "Microsoft.Resources/deployments",
"apiVersion": "2020-06-01",
"name": "addencryptionkey",
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults/keys', 'example-keyvault691', 'kv1')]"
],
"properties": {
"mode": "Incremental",
"template": {
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Storage/storageAccounts",
"name": "allowedstorage691",
"apiVersion": "2022-09-01",
"location": "[resourceGroup().location]",
"sku": {
"name": "Standard_GRS"
},
"identity": {
"type": "SystemAssigned"
},
"kind": "Storage",
"properties": {
"encryption": {
"keySource": "Microsoft.Keyvault",
"keyvaultproperties": {
"keyname": "kv1",
"keyvaulturi": "[reference(resourceId('Microsoft.KeyVault/vaults', 'example-keyvault691'), '2022-07-01', 'Full').properties.vaultUri]"
}
}
}
}
]
}
}
}
]
}
Configure an azurerm_storage_account_customer_managed_key resource and set storage_account_id to the ID of the storage account.
Example configuration:
resource "azurerm_storage_account_customer_managed_key" "valid2" {
storage_account_id = azurerm_storage_account.allowed.id
key_vault_id = azurerm_key_vault.example691.id
key_name = azurerm_key_vault_key.example691.name
}