| name | cis-azure-storage-17.14 |
| description | Ensure Azure Resource Manager Delete locks are applied to Azure Storage Accounts |
| category | cis-azure-storage |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","storage","storage-accounts","locks"] |
| cis_id | 17.14 |
| cis_benchmark | CIS Microsoft Azure Storage Services Benchmark v1.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
17.14 Ensure Azure Resource Manager Delete locks are applied to Azure Storage Accounts (Manual)
Description
Azure Resource Manager CannotDelete (Delete) locks can prevent users from accidentally or maliciously deleting a storage account. This feature ensures that while the Storage account can still be modified or used, deletion of the Storage account resource requires removal of the lock by a user with appropriate permissions.
This feature is a protective control for the availability of data. By ensuring that a storage account or its parent resource group cannot be deleted without first removing the lock, the risk of data loss is reduced.
Rationale
Applying a Delete lock on storage accounts protects the availability of data by preventing the accidental or unauthorized deletion of the entire storage account. It is a fundamental protective control that can prevent data loss.
Impact
- Prevents the deletion of the Storage account Resource entirely.
- Prevents the deletion of the parent Resource Group containing the locked Storage account resource.
- Does not prevent other control plane operations, including modification of configurations, network settings, containers, and access.
- Does not prevent deletion of containers or other objects within the storage account.
Audit Procedure
Audit from Azure Portal
- Navigate to the storage account in the Azure portal.
- For each storage account, under
Settings, click Locks.
- Ensure that a
Delete lock exists on the storage account.
Audit from Azure CLI
az lock list --resource-group <resource-group> \
--resource-name <storage-account> \
--resource-type "Microsoft.Storage/storageAccounts"
Audit from PowerShell
Get-AzResourceLock -ResourceGroupName <RESOURCEGROUPNAME> `
-ResourceName <STORAGEACCOUNTNAME> `
-ResourceType "Microsoft.Storage/storageAccounts"
Audit from Azure Policy
There is currently no built-in Microsoft policy to audit resource locks on storage accounts. Custom and community policy definitions can check for the existence of a "Microsoft.Authorization/locks" resource with an AuditIfNotExists effect.
Expected Result
A Delete (CannotDelete) lock should exist on each storage account. CLI/PowerShell output should list a lock with lockType set to CanNotDelete.
Remediation
