azure_storage_account Resource

Use the azure_storage_account InSpec audit resource to test the properties related to an Azure Storage account.

Azure REST API Version, Endpoint, and HTTP Client Parameters

This resource interacts with API versions supported by the resource provider. The api_version can be defined as a resource parameter. If not provided, this resource uses the latest version. For more information, refer to the azure_generic_resource document.

Unless defined, this resource uses the azure_cloud global endpoint and default values for the HTTP client. For more information, refer to the resource pack README.

Installation

This resource is available in the Chef InSpec Azure resource pack.

See the Chef InSpec documentation on cloud platforms for information on configuring your Azure environment for InSpec and creating an InSpec profile that uses the InSpec Azure resource pack.

Syntax

An azure_storage_account resource block identifies an Azure storage account by name and resource_group, or the resource_id.

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME')  do
  it { should exist }
end

describe azure_storage_account(resource_id: '/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{accountName}') do
  it { should exist }
end

Parameters

resource_group: Azure resource group where the targeted resource resides.
name: The name of the storage account within the specified resource group.
resource_id: The unique resource ID.
activity_log_alert_api_version: The activity log alerts endpoint API version used in the have_recently_generated_access_key matcher. The latest version will be used unless provided.
storage_service_endpoint_api_version: The storage service endpoint API version. 2019-12-12 will be used unless provided.
resource_data: In-memory cached Azure Network security group data. Passing data to this parameter can increase performance since it avoids multiple network calls to the same Azure resource. When provided, it binds the values directly to the resource. Data passed to the resource_data parameter could be stale. It is the user’s responsibility to refresh the data.

Pass one of the following parameter sets for a valid query:

resource_id
resource_group and name
resource_data

Properties

queues<superscript>*</superscript>: Lists all of the queues in a given storage account. See here for more.
queue_properties<superscript>*</superscript>: Gets the properties of a storage account’s Queue service, including properties for Storage Analytics and CORS (Cross-Origin Resource Sharing) rules. See here for more.
blobs<superscript>*</superscript>: Lists all of the blob containers in a given storage account. See here for more.
blob_properties<superscript>*</superscript>: Gets the properties of a storage account’s Blob service, including properties for Storage Analytics and CORS (Cross-Origin Resource Sharing) rules. See here for more.
table_properties<superscript>*</superscript>: Gets the properties of a storage account’s Table service, including properties for Storage Analytics and CORS (Cross-Origin Resource Sharing) rules. See here for more.

*: Note that the Azure endpoints return data in XML format; however, they will be converted to Azure Resource Probe to make the properties accessible via dot notation.

The property names will be in snake case, property_name. Therefore, <EnumerationResults ServiceEndpoint="https://myaccount.queue.core.windows.net/"> can be tested via its('enumeration_results.service_endpoint).

The property names will be in snake case, property_name. Therefore, <EnumerationResults ServiceEndpoint="https://myaccount.blob.core.windows.net/"> can be tested via its('enumeration_results.service_endpoint).

For properties applicable to all resources, such as type, name, id, and properties, refer to azure_generic_resource.

Also, refer to Azure documentation for other properties available. Any attribute in the response may be accessed with the key names separated by dots (.).

Examples

Test the primary endpoints

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  its('properties.primaryEndpoints.blob') { should cmp 'https://mysa.blob.core.windows.net/' }
  its('properties.primaryEndpoints.queue') { should cmp 'https://mysa.queue.core.windows.net/' }
  its('properties.primaryEndpoints.table') { should cmp 'https://mysa.table.core.windows.net/' }
  its('properties.primaryEndpoints.file') { should cmp 'https://mysa.file.core.windows.net/' }
end

Verify that only HTTPS is supported

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  its('properties.supportsHttpsTrafficOnly') { should be true }
end

Test queues service endpoint

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  its('queues.enumeration_results.service_endpoint') { should cmp 'https://mysa.queue.core.windows.net/' }
end

Test Blobs service endpoint

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  its('blobs.enumeration_results.service_endpoint') { should cmp 'https://mysa.blob.core.windows.net/' }
end

Test queue properties logging version

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  its('queue_properties.logging.version') { should cmp '1.0' }
end

Test Blob properties logging version

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  its('blob_properties.logging.version') { should cmp '1.0' }
end

Test table properties logging version

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  its('table_properties.logging.version') { should cmp '1.0' }
end

Loop through all storage accounts and test a blob service endpoint exists from already cached data

azure_storage_accounts.entries.each do |azure_storage_account_data|
    describe azure_storage_account(resource_data: azure_storage_account_data) do
      its('blobs.enumeration_results.service_endpoint') { should cmp 'https://mysa.blob.core.windows.net/' }
    end
end

Matchers

This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our Universal Matchers page.

have_encryption_enabled

Test if encryption is enabled.

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  it { should have_encryption_enabled }
end

have_recently_generated_access_key

Test if an access key has been generated within the last 90 days.

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  it { should have_recently_generated_access_key }
end

exists

# If we expect the resource to always exist.

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  it { should exist }
end

not_exists

# If we expect the resource to never exist.

describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
  it { should_not exist }
end

Azure Permissions

Your Service Principal must be set up with at least a reader role on the subscription you wish to test.