Microsoft.storage.storageaccounts.blobservices.containers.immutabilitypolicies.delete remediation

​

Event Information

1. The “Microsoft.Storage.storageAccounts.blobServices.containers.immutabilityPolicies.delete” event in Azure for Azure Storage refers to the deletion of an immutability policy associated with a container in Azure Blob Storage.
2. This event indicates that the immutability policy, which enforces data immutability and prevents modification or deletion of data within the container for a specified retention period, has been removed.
3. It is important to monitor this event as it can impact data governance and compliance requirements, especially in scenarios where data immutability is crucial, such as regulatory compliance or data protection against ransomware attacks.

​

Examples

1. Unauthorized deletion of immutability policies: If security is impacted with the ability to delete immutability policies in Azure Storage, it could lead to unauthorized deletion of critical data. This could result in data loss, compliance violations, and potential legal implications.
2. Data tampering and integrity issues: Deleting immutability policies can allow malicious actors to tamper with or modify data stored in Azure Storage containers. This can compromise the integrity of the data and undermine the trustworthiness of the stored information.
3. Compliance and regulatory non-compliance: Immutability policies are often implemented to meet specific compliance requirements, such as data retention or legal hold. If these policies can be deleted, it can result in non-compliance with industry regulations and legal obligations, exposing the organization to penalties and reputational damage.

​

Remediation

​

Using Console

1. Enable Storage Analytics Logging:
   • Go to the Azure portal and navigate to the Azure Storage account.
   • Select the “Monitoring” section from the left-hand menu.
   • Click on “Storage Analytics” and then select “Logging”.
   • Enable logging by toggling the switch to “On”.
   • Configure the desired retention period for the logs.
   • Save the changes.
2. Enable Storage Analytics Metrics:
   • In the same “Monitoring” section of the Azure Storage account, click on “Storage Analytics” and then select “Metrics”.
   • Enable metrics by toggling the switch to “On”.
   • Configure the desired retention period for the metrics.
   • Save the changes.
3. Enable Soft Delete for Blob Storage:
   • Navigate to the Azure Storage account and select the “Blob service” from the left-hand menu.
   • Click on “Data protection” and then select “Soft delete”.
   • Enable soft delete by toggling the switch to “On”.
   • Configure the desired retention period for the deleted blobs.
   • Save the changes.

​

Using CLI

1. Enable soft delete for Azure Blob Storage:
   • Use the following command to enable soft delete for a specific storage account:
     Copy

     Ask AI

     az storage account blob-service-properties update --account-name <storage_account_name> --enable-delete-retention true --delete-retention-days <retention_days>
     

     Replace <storage_account_name> with the name of your storage account and <retention_days> with the number of days you want to retain deleted blobs.
2. Enable logging for Azure Storage:
   • Use the following command to enable logging for a specific storage account:
     Copy

     Ask AI

     az storage logging update --account-name <storage_account_name> --log <log_settings>
     

     Replace <storage_account_name> with the name of your storage account and <log_settings> with the desired logging settings.
3. Enable firewall rules for Azure Storage:
   • Use the following command to add a firewall rule for a specific storage account:
     Copy

     Ask AI

     az storage account network-rule add --account-name <storage_account_name> --ip-address <ip_address>
     

     Replace <storage_account_name> with the name of your storage account and <ip_address> with the IP address you want to allow access from.

​

Using Python

1. Monitor and handle storage exceptions:
   • Implement exception handling in your Python code to catch and handle any storage-related exceptions that may occur.
   • Use the try-except block to catch specific exceptions like azure.core.exceptions.ResourceNotFoundError or azure.core.exceptions.ServiceRequestError.
   • Log the exceptions and take appropriate actions, such as retrying the operation or notifying the appropriate stakeholders.
2. Implement access control and security measures:
   • Use the Azure Identity library to authenticate and authorize access to your Azure Storage resources.
   • Follow the principle of least privilege and ensure that only necessary permissions are granted to the storage accounts.
   • Utilize Azure Active Directory (Azure AD) for managing access to your storage resources and implement role-based access control (RBAC) to grant appropriate permissions to users and applications.
3. Optimize storage performance and cost:
   • Leverage Azure Blob Storage lifecycle management to automatically transition data to cooler storage tiers or delete it based on predefined rules.
   • Utilize Azure Blob Storage static website feature to serve static content directly from storage, reducing the need for additional infrastructure.
   • Implement client-side data compression and decompression techniques to optimize storage usage and reduce costs.