Skip to main content

azure_storage_account resource

Use the azure_storage_account InSpec audit resource to test the properties related to an Azure Storage account.

Azure REST API version, endpoint, and HTTP client parameters

This resource interacts with API versions supported by the resource provider. You can specify the api_version as a resource parameter to use a specific version of the Azure REST API. If you don’t specify an API version, this resource uses the latest version available. For more information about API versioning, see the azure_generic_resource.

By default, this resource uses the azure_cloud global endpoint and default HTTP client settings. You can override these settings if you need to connect to a different Azure environment (such as Azure Government or Azure China). For more information about configuration options, see the resource pack README.

Syntax

An azure_storage_account resource block identifies an Azure storage account by name and resource_group, or the resource_id.

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME')  do
  it { should exist }
end

describe azure_storage_account(resource_id: '/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{accountName}') do
  it { should exist }
end

Parameters

resource_group
Azure resource group where the targeted resource resides.
name
The name of the storage account within the specified resource group.
resource_id
The unique resource ID.
activity_log_alert_api_version
The activity log alerts endpoint API version used in the have_recently_generated_access_key matcher. The latest version will be used unless provided.
storage_service_endpoint_api_version
The storage service endpoint API version. 2019-12-12 will be used unless provided.
resource_data
In-memory cached Azure Network security group data. Passing data to this parameter can increase performance since it avoids multiple network calls to the same Azure resource. When provided, it binds the values directly to the resource. Data passed to the resource_data parameter could be stale. It is the user’s responsibility to refresh the data.

Pass one of the following parameter sets for a valid query:

  • resource_id
  • resource_group and name
  • resource_data

Properties

queues<superscript>*</superscript>
Lists all of the queues in a given storage account. For more information, see the Azure Storage Services List Queues documentation.
queue_properties<superscript>*</superscript>
Gets the properties of a storage account’s Queue service, including properties for Storage Analytics and CORS (Cross-Origin Resource Sharing) rules. For more information, see the Azure Queue Service Properties documentation.
blobs<superscript>*</superscript>
Lists all of the blob containers in a given storage account. For more information, see the Azure Storage Services List Containers.
blob_properties<superscript>*</superscript>
Gets the properties of a storage account’s Blob service, including properties for Storage Analytics and CORS (Cross-Origin Resource Sharing) rules. For more information, see the Azure Storage Services Blob Service Properties documentation.
table_properties<superscript>*</superscript>
Gets the properties of a storage account’s Table service, including properties for Storage Analytics and CORS (Cross-Origin Resource Sharing) rules. For more information, see the Azure Storage Services Table Service Properties documentation.

*: These Azure endpoints return data in XML format. However, they’re converted to make the properties accessible with dot notation.

The property names are in snake case, property_name. Therefore, you can test <EnumerationResults ServiceEndpoint="https://myaccount.queue.core.windows.net/"> with its('enumeration_results.service_endpoint).

For properties applicable to all resources, such as type, name, id, and properties, refer to azure_generic_resource.

Also, see the Azure documentation for other available properties. You can access any attribute in the response with the key names separated by dots (.).

Examples

Test the primary endpoints:

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  its('properties.primaryEndpoints.blob') { should cmp 'https://mysa.blob.core.windows.net/' }
  its('properties.primaryEndpoints.queue') { should cmp 'https://mysa.queue.core.windows.net/' }
  its('properties.primaryEndpoints.table') { should cmp 'https://mysa.table.core.windows.net/' }
  its('properties.primaryEndpoints.file') { should cmp 'https://mysa.file.core.windows.net/' }
end

Verify that only HTTPS is supported:

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  its('properties.supportsHttpsTrafficOnly') { should be true }
end

Test queues service endpoint:

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  its('queues.enumeration_results.service_endpoint') { should cmp 'https://mysa.queue.core.windows.net/' }
end

Test Blobs service endpoint:

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  its('blobs.enumeration_results.service_endpoint') { should cmp 'https://mysa.blob.core.windows.net/' }
end

Test queue properties logging version:

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  its('queue_properties.logging.version') { should cmp '1.0' }
end

Test Blob properties logging version:

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  its('blob_properties.logging.version') { should cmp '1.0' }
end

Test table properties logging version:

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  its('table_properties.logging.version') { should cmp '1.0' }
end

Loop through all storage accounts and test a blob service endpoint exists from already cached data:

azure_storage_accounts.entries.each do |azure_storage_account_data|
    describe azure_storage_account(resource_data: azure_storage_account_data) do
      its('blobs.enumeration_results.service_endpoint') { should cmp 'https://mysa.blob.core.windows.net/' }
    end
end

Matchers

This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our Universal Matchers page.

have_encryption_enabled

Test if encryption is enabled.

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  it { should have_encryption_enabled }
end

have_recently_generated_access_key

Test if an access key has been generated within the last 90 days.

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  it { should have_recently_generated_access_key }
end

exists

# If we expect the resource to always exist.

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  it { should exist }
end

not_exists

# If we expect the resource to never exist.

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  it { should_not exist }
end

Azure permissions

Your Service Principal must be set up with at least a reader role on the subscription you wish to test.

Thank you for your feedback!

×