Microsoft.storage.storageaccounts.blobservices.containers.blobs.write remediation

​

Event Information

• The Microsoft.Storage.storageAccounts.blobServices.containers.blobs.write event in Azure for AzureStorage refers to the action of writing or uploading a blob (a file or object) to a container within a blob service of a storage account in Azure.
• This event indicates that a new blob has been created or an existing blob has been updated with new content.
• It is a useful event for monitoring and auditing purposes, as it allows you to track the activity of writing data to Azure Storage, which can be crucial for compliance and security requirements.

​

Examples

1. Unauthorized access: If security is impacted with Microsoft.Storage.storageAccounts.blobServices.containers.blobs.write in Azure for AzureStorage, it could indicate that there is unauthorized access to write data to the blob storage containers. This could be due to misconfigured access controls or compromised credentials, potentially leading to data leakage or unauthorized modifications.
2. Data integrity compromise: Another impact could be the compromise of data integrity. If an attacker gains write access to the blob storage containers, they could potentially modify or tamper with the data stored within. This could result in data corruption or the injection of malicious content, leading to potential security breaches or operational issues.
3. Compliance violations: Security impact with write access to Azure blob storage can also result in compliance violations. If sensitive or regulated data is stored in the affected containers, unauthorized write access could lead to non-compliance with data protection regulations such as GDPR or HIPAA. This could result in legal consequences, financial penalties, and reputational damage for the organization.

​

Remediation

​

Using Console

1. Enable Storage Analytics Logging:
   • Go to the Azure portal and navigate to the Azure Storage account.
   • Select the “Monitoring” section from the left-hand menu.
   • Click on “Storage Analytics” and then select “Logging”.
   • Enable logging by toggling the switch to “On”.
   • Configure the desired retention period for the logs.
   • Save the changes.
2. Enable Storage Analytics Metrics:
   • In the same “Monitoring” section of the Azure Storage account, click on “Storage Analytics” and then select “Metrics”.
   • Enable metrics by toggling the switch to “On”.
   • Configure the desired retention period for the metrics.
   • Save the changes.
3. Enable Soft Delete for Blob Storage:
   • Navigate to the Azure Storage account and select the “Blob service” from the left-hand menu.
   • Click on “Data protection” and then select “Soft delete”.
   • Enable soft delete by toggling the switch to “On”.
   • Configure the desired retention period for the soft deleted blobs.
   • Save the changes.

​

Using CLI

1. Enable soft delete for Azure Blob Storage:
   • Use the following command to enable soft delete for a specific storage account:
     Copy

     Ask AI

     az storage account blob-service-properties update --account-name <storage_account_name> --enable-delete-retention true --delete-retention-days <retention_days>
     

     Replace <storage_account_name> with the name of your storage account and <retention_days> with the number of days you want to retain deleted blobs.
2. Enable logging for Azure Storage:
   • Use the following command to enable logging for a specific storage account:
     Copy

     Ask AI

     az storage logging update --account-name <storage_account_name> --log <log_settings>
     

     Replace <storage_account_name> with the name of your storage account and <log_settings> with the desired logging settings.
3. Enable firewall rules for Azure Storage:
   • Use the following command to add a firewall rule for a specific storage account:
     Copy

     Ask AI

     az storage account network-rule add --account-name <storage_account_name> --ip-address <ip_address>
     

     Replace <storage_account_name> with the name of your storage account and <ip_address> with the IP address you want to allow access from.

​

Using Python

1. Monitor and handle storage exceptions:
   • Implement exception handling in your Python code to catch and handle any storage-related exceptions that may occur.
   • Use the try-except block to catch specific exceptions like azure.core.exceptions.ResourceNotFoundError or azure.core.exceptions.ServiceRequestError.
   • Handle the exceptions appropriately, such as logging the error, retrying the operation, or taking any necessary corrective actions.
2. Implement access control and security measures:
   • Ensure that appropriate access controls are in place for your Azure Storage resources.
   • Use Azure Active Directory (Azure AD) to authenticate and authorize access to your storage accounts.
   • Implement role-based access control (RBAC) to grant specific permissions to users or groups.
   • Regularly review and update access policies to ensure least privilege access.
3. Enable logging and monitoring:
   • Enable diagnostic logging for your Azure Storage accounts to capture relevant logs and metrics.
   • Use Azure Monitor to collect and analyze the logs and metrics.
   • Set up alerts and notifications to proactively detect and respond to any storage-related issues.
   • Leverage Azure Application Insights or other monitoring tools to gain insights into the performance and health of your storage resources.