Storage Logging For Read Write And Delete Requests Disabled

  • Query id: 43f6e60c-9cdb-4e77-864d-a66595d26518
  • Query name: Storage Logging For Read Write And Delete Requests Disabled
  • Platform: AzureResourceManager
  • Severity: Medium
  • Category: Observability
  • CWE: 778
  • URL: Github

Description

Storage Logging should be enabled for read, write and delete methods
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - bicep file
resource default_Microsoft_Insights 'Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings@2017-05-01-preview' = {
  name: 'Microsoft.Storage/storageAccounts/queueServices/providers'
  properties: {
    logs: [
      {
        category: 'StorageRead'
        enabled: false
      }
      {
        category: 'StorageWrite'
        enabled: false
      }
      {
        category: 'StorageDelete'
        enabled: false
      }
    ]
  }
}
Positive test num. 2 - json file
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageAccountName": {
      "type": "string"
    },
    "settingName": {
      "type": "string"
    },
    "storageSyncName": {
      "type": "string"
    },
    "workspaceId": {
      "type": "string"
    }
  },
  "resources": [
    {
      "apiVersion": "2019-10-01",
      "name": "nested",
      "type": "Microsoft.Resources/deployments",
      "properties": {
        "mode": "Incremental",
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "parameters": {
          "endpoints": {
            "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01', 'Full').properties.primaryEndpoints]"
          },
          "settingName": {
            "value": "[parameters('settingName')]"
          },
          "storageAccountName": {
            "value": "[parameters('storageAccountName')]"
          },
          "storageSyncName": {
            "value": "[parameters('storageSyncName')]"
          },
          "workspaceId": {
            "value": "[parameters('workspaceId')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {
            "endpoints": {
              "type": "object"
            },
            "settingName": {
              "type": "String"
            },
            "storageAccountName": {
              "type": "String"
            },
            "storageSyncName": {
              "type": "String"
            },
            "workspaceId": {
              "type": "String"
            }
          },
          "variables": {
            "hasqueue": "[contains(parameters('endpoints'),'queue')]"
          },
          "resources": [
            {
              "condition": "[variables('hasqueue')]",
              "type": "Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings",
              "apiVersion": "2017-05-01-preview",
              "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]",
              "properties": {
                "workspaceId": "[parameters('workspaceId')]",
                "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSyncName'))]",
                "logs": [
                  {
                    "category": "StorageRead",
                    "enabled": false
                  },
                  {
                    "category": "StorageWrite",
                    "enabled": false
                  },
                  {
                    "category": "StorageDelete",
                    "enabled": false
                  }
                ],
                "metrics": [
                  {
                    "category": "Transaction",
                    "enabled": true
                  }
                ]
              }
            }
          ]
        }
      }
    }
  ]
}
Positive test num. 3 - bicep file
resource default_Microsoft_Insights 'Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings@2017-05-01-preview' = {
  name: 'Microsoft.Storage/storageAccounts/queueServices/providers'
  properties:{
    logs:[]
  }
}

Positive test num. 4 - json file 
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageAccountName": {
      "type": "string"
    },
    "settingName": {
      "type": "string"
    },
    "storageSyncName": {
      "type": "string"
    },
    "workspaceId": {
      "type": "string"
    }
  },
  "resources": [
    {
      "apiVersion": "2019-10-01",
      "name": "nested",
      "type": "Microsoft.Resources/deployments",
      "properties": {
        "mode": "Incremental",
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "parameters": {
          "endpoints": {
            "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01', 'Full').properties.primaryEndpoints]"
          },
          "settingName": {
            "value": "[parameters('settingName')]"
          },
          "storageAccountName": {
            "value": "[parameters('storageAccountName')]"
          },
          "storageSyncName": {
            "value": "[parameters('storageSyncName')]"
          },
          "workspaceId": {
            "value": "[parameters('workspaceId')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {
            "endpoints": {
              "type": "object"
            },
            "settingName": {
              "type": "String"
            },
            "storageAccountName": {
              "type": "String"
            },
            "storageSyncName": {
              "type": "String"
            },
            "workspaceId": {
              "type": "String"
            }
          },
          "variables": {
            "hasqueue": "[contains(parameters('endpoints'),'queue')]"
          },
          "resources": [
            {
              "condition": "[variables('hasqueue')]",
              "type": "Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings",
              "apiVersion": "2017-05-01-preview",
              "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]",
              "properties": {
                "workspaceId": "[parameters('workspaceId')]",
                "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSyncName'))]",
                "logs": [
                  {
                    "category": "StorageRead",
                    "enabled": false
                  }
                ],
                "metrics": [
                  {
                    "category": "Transaction",
                    "enabled": true
                  }
                ]
              }
            }
          ]
        }
      }
    }
  ]
}
Positive test num. 5 - bicep file 
resource default_Microsoft_Insights 'Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings@2017-05-01-preview' = {
  name: 'Microsoft.Storage/storageAccounts/queueServices/providers'
  properties: {
    logs: [
      {
        category: 'StorageRead'
        enabled: false
      }
      {
        category: 'StorageWrite'
        enabled: true
      }
      {
        category: 'StorageDelete'
        enabled: false
      }
    ]
  }
}
Positive test num. 6 - json file 
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageAccountName": {
      "type": "string"
    },
    "settingName": {
      "type": "string"
    },
    "storageSyncName": {
      "type": "string"
    },
    "workspaceId": {
      "type": "string"
    }
  },
  "resources": [
    {
      "apiVersion": "2019-10-01",
      "name": "nested",
      "type": "Microsoft.Resources/deployments",
      "properties": {
        "mode": "Incremental",
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "parameters": {
          "endpoints": {
            "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01', 'Full').properties.primaryEndpoints]"
          },
          "settingName": {
            "value": "[parameters('settingName')]"
          },
          "storageAccountName": {
            "value": "[parameters('storageAccountName')]"
          },
          "storageSyncName": {
            "value": "[parameters('storageSyncName')]"
          },
          "workspaceId": {
            "value": "[parameters('workspaceId')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {
            "endpoints": {
              "type": "object"
            },
            "settingName": {
              "type": "String"
            },
            "storageAccountName": {
              "type": "String"
            }
          },
          "variables": {
            "hasqueue": "[contains(parameters('endpoints'),'queue')]"
          },
          "resources": [
            {
              "condition": "[variables('hasqueue')]",
              "type": "Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings",
              "apiVersion": "2017-05-01-preview",
              "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]"
            }
          ]
        }
      }
    }
  ]
}
Positive test num. 7 - bicep file 
resource default_Microsoft_Insights 'Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings@2017-05-01-preview' = {
  name: 'Microsoft.Storage/storageAccounts/queueServices/providers'
  properties: {
    logs: [
      {
        category: 'StorageWrite'
        enabled: true
      }
    ]
  }
}
Positive test num. 8 - json file 
{
  "properties": {
    "template": {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
        "storageAccountName": {
          "type": "string"
        },
        "settingName": {
          "type": "string"
        },
        "storageSyncName": {
          "type": "string"
        },
        "workspaceId": {
          "type": "string"
        }
      },
      "resources": [
        {
          "apiVersion": "2019-10-01",
          "name": "nested",
          "type": "Microsoft.Resources/deployments",
          "properties": {
            "mode": "Incremental",
            "expressionEvaluationOptions": {
              "scope": "inner"
            },
            "parameters": {
              "endpoints": {
                "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01', 'Full').properties.primaryEndpoints]"
              },
              "settingName": {
                "value": "[parameters('settingName')]"
              },
              "storageAccountName": {
                "value": "[parameters('storageAccountName')]"
              },
              "storageSyncName": {
                "value": "[parameters('storageSyncName')]"
              },
              "workspaceId": {
                "value": "[parameters('workspaceId')]"
              }
            },
            "template": {
              "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
              "contentVersion": "1.0.0.0",
              "parameters": {
                "endpoints": {
                  "type": "object"
                },
                "settingName": {
                  "type": "String"
                },
                "storageAccountName": {
                  "type": "String"
                },
                "storageSyncName": {
                  "type": "String"
                },
                "workspaceId": {
                  "type": "String"
                }
              },
              "variables": {
                "hasqueue": "[contains(parameters('endpoints'),'queue')]"
              },
              "resources": [
                {
                  "condition": "[variables('hasqueue')]",
                  "type": "Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings",
                  "apiVersion": "2017-05-01-preview",
                  "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]",
                  "properties": {
                    "workspaceId": "[parameters('workspaceId')]",
                    "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSyncName'))]",
                    "logs": [
                      {
                        "category": "StorageRead",
                        "enabled": false
                      },
                      {
                        "category": "StorageWrite",
                        "enabled": false
                      },
                      {
                        "category": "StorageDelete",
                        "enabled": false
                      }
                    ],
                    "metrics": [
                      {
                        "category": "Transaction",
                        "enabled": true
                      }
                    ]
                  }
                }
              ]
            }
          }
        }
      ],
      "outputs": {}
    },
    "parameters": {}
  },
  "kind": "template",
  "type": "Microsoft.Blueprint/blueprints/artifacts",
  "name": "myTemplate"
}
Positive test num. 9 - bicep file 
resource default_Microsoft_Insights 'Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings@2017-05-01-preview' = {
  name: 'Microsoft.Storage/storageAccounts/queueServices/providers'
  properties: {
    logs: [
      {
        category: 'StorageWrite'
        enabled: false
      }
    ]
  }
}
Positive test num. 10 - json file 
{
  "properties": {
    "template": {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
        "storageAccountName": {
          "type": "string"
        },
        "settingName": {
          "type": "string"
        },
        "storageSyncName": {
          "type": "string"
        },
        "workspaceId": {
          "type": "string"
        }
      },
      "resources": [
        {
          "apiVersion": "2019-10-01",
          "name": "nested",
          "type": "Microsoft.Resources/deployments",
          "properties": {
            "mode": "Incremental",
            "expressionEvaluationOptions": {
              "scope": "inner"
            },
            "parameters": {
              "endpoints": {
                "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01', 'Full').properties.primaryEndpoints]"
              },
              "settingName": {
                "value": "[parameters('settingName')]"
              },
              "storageAccountName": {
                "value": "[parameters('storageAccountName')]"
              },
              "storageSyncName": {
                "value": "[parameters('storageSyncName')]"
              },
              "workspaceId": {
                "value": "[parameters('workspaceId')]"
              }
            },
            "template": {
              "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
              "contentVersion": "1.0.0.0",
              "parameters": {
                "endpoints": {
                  "type": "object"
                },
                "settingName": {
                  "type": "String"
                },
                "storageAccountName": {
                  "type": "String"
                },
                "storageSyncName": {
                  "type": "String"
                },
                "workspaceId": {
                  "type": "String"
                }
              },
              "variables": {
                "hasqueue": "[contains(parameters('endpoints'),'queue')]"
              },
              "resources": [
                {
                  "condition": "[variables('hasqueue')]",
                  "type": "Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings",
                  "apiVersion": "2017-05-01-preview",
                  "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]",
                  "properties": {
                    "workspaceId": "[parameters('workspaceId')]",
                    "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSyncName'))]",
                    "logs": [
                      {
                        "category": "StorageRead",
                        "enabled": false
                      }
                    ],
                    "metrics": [
                      {
                        "category": "Transaction",
                        "enabled": true
                      }
                    ]
                  }
                }
              ]
            }
          }
        }
      ],
      "outputs": {}
    },
    "parameters": {}
  },
  "kind": "template",
  "type": "Microsoft.Blueprint/blueprints/artifacts",
  "name": "myTemplate"
}
Positive test num. 11 - bicep file 
resource default_Microsoft_Insights 'Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings@2017-05-01-preview' = {
  name: 'Microsoft.Storage/storageAccounts/queueServices/providers'
}
Positive test num. 12 - json file 
{
  "properties": {
    "template": {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
        "storageAccountName": {
          "type": "string"
        },
        "settingName": {
          "type": "string"
        },
        "storageSyncName": {
          "type": "string"
        },
        "workspaceId": {
          "type": "string"
        }
      },
      "resources": [
        {
          "apiVersion": "2019-10-01",
          "name": "nested",
          "type": "Microsoft.Resources/deployments",
          "properties": {
            "mode": "Incremental",
            "expressionEvaluationOptions": {
              "scope": "inner"
            },
            "parameters": {
              "endpoints": {
                "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01', 'Full').properties.primaryEndpoints]"
              },
              "settingName": {
                "value": "[parameters('settingName')]"
              },
              "storageAccountName": {
                "value": "[parameters('storageAccountName')]"
              },
              "storageSyncName": {
                "value": "[parameters('storageSyncName')]"
              },
              "workspaceId": {
                "value": "[parameters('workspaceId')]"
              }
            },
            "template": {
              "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
              "contentVersion": "1.0.0.0",
              "parameters": {
                "endpoints": {
                  "type": "object"
                },
                "settingName": {
                  "type": "String"
                },
                "storageAccountName": {
                  "type": "String"
                }
              },
              "variables": {
                "hasqueue": "[contains(parameters('endpoints'),'queue')]"
              },
              "resources": [
                {
                  "condition": "[variables('hasqueue')]",
                  "type": "Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings",
                  "apiVersion": "2017-05-01-preview",
                  "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]"
                }
              ]
            }
          }
        }
      ],
      "outputs": {}
    },
    "parameters": {}
  },
  "kind": "template",
  "type": "Microsoft.Blueprint/blueprints/artifacts",
  "name": "myTemplate"
}
Positive test num. 13 - bicep file 
resource default_Microsoft_Insights 'Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings@2017-05-01-preview' = {
  name: 'Microsoft.Storage/storageAccounts/queueServices/providers'
  properties: {}
}

Code samples without security vulnerabilities

Negative test num. 1 - bicep file
resource default_Microsoft_Insights 'Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings@2017-05-01-preview' = {
  name: 'Microsoft.Storage/storageAccounts/queueServices/providers'
  properties: {
    logs: [
      {
        category: 'StorageRead'
        enabled: true
      }
      {
        category: 'StorageWrite'
        enabled: true
      }
      {
        category: 'StorageDelete'
        enabled: true
      }
    ]
  }
}
Negative test num. 2 - json file
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageAccountName": {
      "type": "string"
    },
    "settingName": {
      "type": "string"
    },
    "storageSyncName": {
      "type": "string"
    },
    "workspaceId": {
      "type": "string"
    }
  },
  "resources": [
    {
      "apiVersion": "2019-10-01",
      "name": "nested",
      "type": "Microsoft.Resources/deployments",
      "properties": {
        "mode": "Incremental",
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "parameters": {
          "endpoints": {
            "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01', 'Full').properties.primaryEndpoints]"
          },
          "settingName": {
            "value": "[parameters('settingName')]"
          },
          "storageAccountName": {
            "value": "[parameters('storageAccountName')]"
          },
          "storageSyncName": {
            "value": "[parameters('storageSyncName')]"
          },
          "workspaceId": {
            "value": "[parameters('workspaceId')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {
            "endpoints": {
              "type": "object"
            },
            "settingName": {
              "type": "String"
            },
            "storageAccountName": {
              "type": "String"
            },
            "storageSyncName": {
              "type": "String"
            },
            "workspaceId": {
              "type": "String"
            }
          },
          "variables": {
            "hasqueue": "[contains(parameters('endpoints'),'queue')]"
          },
          "resources": [
            {
              "condition": "[variables('hasqueue')]",
              "type": "Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings",
              "apiVersion": "2017-05-01-preview",
              "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]",
              "properties": {
                "workspaceId": "[parameters('workspaceId')]",
                "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSyncName'))]",
                "logs": [
                  {
                    "category": "StorageRead",
                    "enabled": true
                  },
                  {
                    "category": "StorageWrite",
                    "enabled": true
                  },
                  {
                    "category": "StorageDelete",
                    "enabled": true
                  }
                ],
                "metrics": [
                  {
                    "category": "Transaction",
                    "enabled": true
                  }
                ]
              }
            }
          ]
        }
      }
    }
  ]
}
Negative test num. 3 - json file
{
  "properties": {
    "template": {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
        "storageAccountName": {
          "type": "string"
        },
        "settingName": {
          "type": "string"
        },
        "storageSyncName": {
          "type": "string"
        },
        "workspaceId": {
          "type": "string"
        }
      },
      "resources": [
        {
          "apiVersion": "2019-10-01",
          "name": "nested",
          "type": "Microsoft.Resources/deployments",
          "properties": {
            "mode": "Incremental",
            "expressionEvaluationOptions": {
              "scope": "inner"
            },
            "parameters": {
              "endpoints": {
                "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01', 'Full').properties.primaryEndpoints]"
              },
              "settingName": {
                "value": "[parameters('settingName')]"
              },
              "storageAccountName": {
                "value": "[parameters('storageAccountName')]"
              },
              "storageSyncName": {
                "value": "[parameters('storageSyncName')]"
              },
              "workspaceId": {
                "value": "[parameters('workspaceId')]"
              }
            },
            "template": {
              "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
              "contentVersion": "1.0.0.0",
              "parameters": {
                "endpoints": {
                  "type": "object"
                },
                "settingName": {
                  "type": "String"
                },
                "storageAccountName": {
                  "type": "String"
                },
                "storageSyncName": {
                  "type": "String"
                },
                "workspaceId": {
                  "type": "String"
                }
              },
              "variables": {
                "hasqueue": "[contains(parameters('endpoints'),'queue')]"
              },
              "resources": [
                {
                  "condition": "[variables('hasqueue')]",
                  "type": "Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings",
                  "apiVersion": "2017-05-01-preview",
                  "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]",
                  "properties": {
                    "workspaceId": "[parameters('workspaceId')]",
                    "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSyncName'))]",
                    "logs": [
                      {
                        "category": "StorageRead",
                        "enabled": true
                      },
                      {
                        "category": "StorageWrite",
                        "enabled": true
                      },
                      {
                        "category": "StorageDelete",
                        "enabled": true
                      }
                    ],
                    "metrics": [
                      {
                        "category": "Transaction",
                        "enabled": true
                      }
                    ]
                  }
                }
              ]
            }
          }
        }
      ],
      "outputs": {}
    },
    "parameters": {}
  },
  "kind": "template",
  "type": "Microsoft.Blueprint/blueprints/artifacts",
  "name": "myTemplate"
}