Microsoft.storage.storageaccounts.queueservices.queues.delete

​

Event Information

1. The Microsoft.Storage.storageAccounts.queueServices.queues.delete event in Azure for Azure Storage indicates that a queue has been deleted within a storage account.
2. This event is triggered when a user or an automated process initiates the deletion of a specific queue in Azure Storage.
3. It is important to note that this event does not provide information about the contents of the deleted queue, but rather focuses on the deletion action itself.

​

Examples

1. Unauthorized deletion: If security is impacted with Microsoft.Storage.storageAccounts.queueServices.queues.delete in Azure for AzureStorage, it could mean that an unauthorized user or entity is able to delete queues within the storage account. This could lead to the loss of important data or disrupt critical business processes that rely on the queues.
2. Data leakage: Another security impact could be the potential for data leakage. If an attacker gains access to delete queues, they may also be able to access and delete the messages within those queues. This could result in the exposure of sensitive information or the loss of important data.
3. Denial of Service (DoS): The deletion of queues could also be used as a means to launch a Denial of Service (DoS) attack. By continuously deleting queues, an attacker could disrupt the normal functioning of the storage account and prevent legitimate users from accessing the queues or processing messages. This could result in service downtime and financial losses for the organization.

​

Remediation

​

Using Console

1. Enable Storage Analytics Logging:
   • Go to the Azure portal and navigate to the Azure Storage account.
   • Select the “Monitoring” section from the left-hand menu.
   • Click on “Storage Analytics” and then select “Logging”.
   • Enable logging by toggling the switch to “On”.
   • Configure the desired retention period for the logs.
   • Save the changes.
2. Enable Storage Analytics Metrics:
   • In the same “Monitoring” section of the Azure Storage account, click on “Storage Analytics” and then select “Metrics”.
   • Enable metrics by toggling the switch to “On”.
   • Configure the desired retention period for the metrics.
   • Save the changes.
3. Enable Soft Delete for Blob Storage:
   • Navigate to the Azure Storage account and select the “Blob service” from the left-hand menu.
   • Click on “Data protection” and then select “Soft delete”.
   • Enable soft delete by toggling the switch to “On”.
   • Configure the desired retention period for the deleted blobs.
   • Save the changes.

​

Using CLI

1. Enable soft delete for Azure Blob Storage:
   • Use the following command to enable soft delete for a specific storage account:
     Copy

     Ask AI

     az storage account blob-service-properties update --account-name <storage_account_name> --enable-delete-retention true --delete-retention-days <retention_days>
     

     Replace <storage_account_name> with the name of your storage account and <retention_days> with the number of days you want to retain deleted blobs.
2. Enable logging for Azure Storage:
   • Use the following command to enable logging for a specific storage account:
     Copy

     Ask AI

     az storage logging update --account-name <storage_account_name> --log <log_settings>
     

     Replace <storage_account_name> with the name of your storage account and <log_settings> with the desired logging settings.
3. Enable firewall rules for Azure Storage:
   • Use the following command to add a firewall rule for a specific storage account:
     Copy

     Ask AI

     az storage account network-rule add --account-name <storage_account_name> --ip-address <ip_address>
     

     Replace <storage_account_name> with the name of your storage account and <ip_address> with the IP address you want to allow access from.

​

Using Python

1. Monitor and handle storage exceptions:
   • Implement exception handling in your Python code to catch and handle any storage-related exceptions that may occur.
   • Use the try-except block to catch specific exceptions like azure.core.exceptions.ResourceNotFoundError or azure.core.exceptions.ServiceRequestError.
   • Log the exceptions and take appropriate actions, such as retrying the operation or notifying the appropriate stakeholders.
2. Implement access control and security measures:
   • Use the Azure Identity library to authenticate and authorize access to Azure Storage resources in your Python code.
   • Follow the principle of least privilege and ensure that the necessary permissions are granted to the application or user accessing the storage account.
   • Utilize Azure Active Directory (AAD) integration for fine-grained access control and RBAC (Role-Based Access Control) to manage access to storage resources.
3. Optimize storage performance and cost:
   • Leverage Azure Blob Storage lifecycle management to automatically transition data between storage tiers based on its age or access patterns.
   • Utilize Azure Blob Storage’s built-in features like blob indexing and metadata to improve searchability and organization of your data.
   • Implement client-side parallelism in your Python code to improve upload and download speeds, especially for large files, by utilizing multiple threads or processes.