Microsoft.storage.storageaccounts.blobservices.containers.delete remediation

​

Event Information

1. The Microsoft.Storage.storageAccounts.blobServices.containers.delete event in Azure for Azure Storage indicates that a container within a blob service has been deleted.
2. This event signifies that all the blobs and metadata associated with the deleted container are permanently removed from the Azure Storage account.
3. It is important to monitor this event as it can help track container deletions, identify potential data loss, and ensure compliance with data retention policies.

​

Examples

1. Unauthorized deletion: If security is impacted with Microsoft.Storage.storageAccounts.blobServices.containers.delete in Azure for Azure Storage, it could potentially allow unauthorized individuals to delete containers within a storage account. This could result in the loss of critical data or disruption of services.
2. Data leakage: If security is impacted with Microsoft.Storage.storageAccounts.blobServices.containers.delete in Azure for Azure Storage, it could lead to data leakage if an attacker gains access to delete containers. They could potentially delete containers containing sensitive or confidential data, leading to data exposure and potential compliance violations.
3. Service disruption: If security is impacted with Microsoft.Storage.storageAccounts.blobServices.containers.delete in Azure for Azure Storage, it could result in service disruption if containers containing essential resources or dependencies are deleted. This could impact the availability and functionality of applications or services relying on those containers, leading to downtime and potential financial losses.

​

Remediation

​

Using Console

1. Enable Storage Analytics Logging:
   • Go to the Azure portal and navigate to the Azure Storage account.
   • Select the “Monitoring” section from the left-hand menu.
   • Click on “Storage Analytics” and then select “Logging”.
   • Enable logging by toggling the switch to “On”.
   • Configure the desired retention period for the logs.
   • Save the changes.
2. Enable Storage Analytics Metrics:
   • In the same “Monitoring” section of the Azure Storage account, click on “Storage Analytics” and then select “Metrics”.
   • Enable metrics by toggling the switch to “On”.
   • Configure the desired retention period for the metrics.
   • Save the changes.
3. Enable Soft Delete for Blob Storage:
   • Navigate to the Azure Storage account and select the “Blob service” from the left-hand menu.
   • Click on “Data protection” and then select “Soft delete”.
   • Enable soft delete by toggling the switch to “On”.
   • Configure the desired retention period for the deleted blobs.
   • Save the changes.

​

Using CLI

1. Enable soft delete for Azure Blob Storage:
   • Use the following command to enable soft delete for a specific storage account:
     Copy

     Ask AI

     az storage account blob-service-properties update --account-name <storage_account_name> --enable-delete-retention true --delete-retention-days <retention_days>
     

     Replace <storage_account_name> with the name of your storage account and <retention_days> with the number of days you want to retain deleted blobs.
2. Enable logging for Azure Storage:
   • Use the following command to enable logging for a specific storage account:
     Copy

     Ask AI

     az storage logging update --account-name <storage_account_name> --log <log_settings>
     

     Replace <storage_account_name> with the name of your storage account and <log_settings> with the desired logging settings.
3. Enable firewall rules for Azure Storage:
   • Use the following command to add a firewall rule for a specific storage account:
     Copy

     Ask AI

     az storage account network-rule add --account-name <storage_account_name> --ip-address <ip_address>
     

     Replace <storage_account_name> with the name of your storage account and <ip_address> with the IP address you want to allow access to the storage account.

​

Using Python

1. Monitor and handle storage exceptions:
   • Implement exception handling in your Python code to catch and handle any storage-related exceptions that may occur.
   • Use the try-except block to catch specific exceptions like azure.core.exceptions.ResourceNotFoundError or azure.core.exceptions.ServiceRequestError.
   • Handle the exceptions appropriately, such as logging the error, retrying the operation, or notifying the appropriate stakeholders.
2. Implement access control and security measures:
   • Ensure that appropriate access control measures are in place for your Azure Storage resources.
   • Use Azure Active Directory (Azure AD) to authenticate and authorize access to your storage accounts.
   • Implement role-based access control (RBAC) to grant specific permissions to users or groups.
   • Regularly review and update access control policies to adhere to the principle of least privilege.
3. Enable logging and monitoring:
   • Enable diagnostic logging for your Azure Storage accounts to capture relevant logs and metrics.
   • Use Azure Monitor to collect and analyze the logs and metrics.
   • Set up alerts and notifications based on specific conditions or thresholds to proactively identify and address any issues.
   • Leverage Azure Application Insights or other monitoring tools to gain insights into the performance and behavior of your storage resources.