| name | cis-azure-foundations-9.3.11 |
| description | Ensure Redundancy is set to 'geo-redundant storage (GRS)' on critical Azure Storage Accounts |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","storage-accounts","geo-redundancy","grs","disaster-recovery","availability"] |
| cis_id | 9.3.11 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Ensure Redundancy is set to 'geo-redundant storage (GRS)' on critical Azure Storage Accounts
Description
Geo-redundant storage (GRS) in Azure replicates data three times within the primary region using locally redundant storage (LRS) and asynchronously copies it to a secondary region hundreds of miles away. This setup ensures high availability and resilience by providing 16 nines (99.99999999999999%) durability over a year, safeguarding data against regional outages.
Rationale
Enabling GRS protects critical data from regional failures by maintaining a copy in a geographically separate location. This significantly reduces the risk of data loss, supports business continuity, and meets high availability requirements for disaster recovery.
Impact
Enabling geo-redundant storage on Azure storage accounts increases costs due to cross-region data replication.
Audit Procedure
Audit from Azure Portal
- Go to
Storage accounts.
- Click on a storage account.
- Under
Data management, click Redundancy.
- Ensure that
Redundancy is set to Geo-redundant storage (GRS).
- Repeat steps 1-4 for each storage account.
Audit from Azure CLI
Run the following command to list storage accounts:
az storage account list
For each storage account, run the following command:
az storage account show --resource-group <resource-group> --name <storage-account>
Under sku, ensure that name is set to Standard_GRS.
Audit from PowerShell
Run the following command to list storage accounts:
Get-AzStorageAccount
Run the following command to get the storage account in a resource group with a given name:
$storageAccount = Get-AzStorageAccount -ResourceGroupName <resource-group> -Name <storage-account>
Run the following command to get the redundancy setting for the storage account:
$storageAccount.SKU.Name
Ensure that the command returns Standard_GRS.
Expected Result
sku.name should be Standard_GRS for all critical storage accounts.
