azure_storage_account Resource
Use the azure_storage_account
InSpec audit resource to test the properties related to an Azure Storage account.
Azure REST API Version, Endpoint, and HTTP Client Parameters
This resource interacts with API versions supported by the resource provider.
The api_version
can be defined as a resource parameter.
If not provided, this resource uses the latest version.
For more information, refer to the azure_generic_resource
document.
Unless defined, this resource uses the azure_cloud
global endpoint and default values for the HTTP client.
For more information, refer to the resource pack README.
Install
This resource is available in the Chef InSpec Azure resource pack.
For information on configuring your Azure environment for Chef InSpec and creating an InSpec profile that uses the InSpec Azure resource pack, see the Chef InSpec documentation for the Azure cloud platform.
Syntax
An azure_storage_account
resource block identifies an Azure storage account by name
and resource_group
, or the resource_id
.
describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
it { should exist }
end
describe azure_storage_account(resource_id: '/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{accountName}') do
it { should exist }
end
Parameters
resource_group
- Azure resource group where the targeted resource resides.
name
- The name of the storage account within the specified resource group.
resource_id
- The unique resource ID.
activity_log_alert_api_version
- The activity log alerts endpoint API version used in the
have_recently_generated_access_key
matcher. The latest version will be used unless provided. storage_service_endpoint_api_version
- The storage service endpoint API version.
2019-12-12
will be used unless provided. resource_data
- In-memory cached Azure Network security group data. Passing data to this parameter can increase performance since it avoids multiple network calls to the same Azure resource. When provided, it binds the values directly to the resource. Data passed to the
resource_data
parameter could be stale. It is the user’s responsibility to refresh the data.
Pass one of the following parameter sets for a valid query:
resource_id
resource_group
andname
resource_data
Properties
queues<superscript>*</superscript>
- Lists all of the queues in a given storage account. See here for more.
queue_properties<superscript>*</superscript>
- Gets the properties of a storage account’s Queue service, including properties for Storage Analytics and CORS (Cross-Origin Resource Sharing) rules. See here for more.
blobs<superscript>*</superscript>
- Lists all of the blob containers in a given storage account. See here for more.
blob_properties<superscript>*</superscript>
- Gets the properties of a storage account’s Blob service, including properties for Storage Analytics and CORS (Cross-Origin Resource Sharing) rules. See here for more.
table_properties<superscript>*</superscript>
- Gets the properties of a storage account’s Table service, including properties for Storage Analytics and CORS (Cross-Origin Resource Sharing) rules. See here for more.
The property names will be in snake case, property_name
. Therefore, <EnumerationResults ServiceEndpoint="https://myaccount.queue.core.windows.net/">
can be tested via its('enumeration_results.service_endpoint)
.
The property names will be in snake case, property_name
. Therefore, <EnumerationResults ServiceEndpoint="https://myaccount.blob.core.windows.net/">
can be tested via its('enumeration_results.service_endpoint)
.
For properties applicable to all resources, such as type
, name
, id
, and properties
, refer to azure_generic_resource
.
Also, refer to Azure documentation for other properties available. Any attribute in the response may be accessed with the key names separated by dots (.
).
Examples
Test the primary endpoints
describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
its('properties.primaryEndpoints.blob') { should cmp 'https://mysa.blob.core.windows.net/' }
its('properties.primaryEndpoints.queue') { should cmp 'https://mysa.queue.core.windows.net/' }
its('properties.primaryEndpoints.table') { should cmp 'https://mysa.table.core.windows.net/' }
its('properties.primaryEndpoints.file') { should cmp 'https://mysa.file.core.windows.net/' }
end
Verify that only HTTPS is supported
describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
its('properties.supportsHttpsTrafficOnly') { should be true }
end
Test queues service endpoint
describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
its('queues.enumeration_results.service_endpoint') { should cmp 'https://mysa.queue.core.windows.net/' }
end
Test Blobs service endpoint
describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
its('blobs.enumeration_results.service_endpoint') { should cmp 'https://mysa.blob.core.windows.net/' }
end
Test queue properties logging version
describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
its('queue_properties.logging.version') { should cmp '1.0' }
end
Test Blob properties logging version
describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
its('blob_properties.logging.version') { should cmp '1.0' }
end
Test table properties logging version
describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
its('table_properties.logging.version') { should cmp '1.0' }
end
Loop through all storage accounts and test a blob service endpoint exists from already cached data
azure_storage_accounts.entries.each do |azure_storage_account_data|
describe azure_storage_account(resource_data: azure_storage_account_data) do
its('blobs.enumeration_results.service_endpoint') { should cmp 'https://mysa.blob.core.windows.net/' }
end
end
Matchers
This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our Universal Matchers page.
have_encryption_enabled
Test if encryption is enabled.
describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
it { should have_encryption_enabled }
end
have_recently_generated_access_key
Test if an access key has been generated within the last 90 days.
describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
it { should have_recently_generated_access_key }
end
exists
# If we expect the resource to always exist.
describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
it { should exist }
end
not_exists
# If we expect the resource to never exist.
describe azure_storage_account(resource_group: 'RESOURCE_GROUP', name: 'NAME') do
it { should_not exist }
end
Azure Permissions
Your Service Principal must be set up with at least a reader
role on the subscription you wish to test.