ScoutSuite
ScoutSuite copied to clipboard
Azure 'Access Keys Not Rotated' rule flags storage accounts with access key support disabled
Describe the bug
ScoutSuite incorrectly flags Storage Accounts that do not allow access keys as having never been rotated.
To Reproduce
Create a storage account that does not permit access key-based access using the az
CLI tool:
$ az group create --location germanywestcentral --resource-group storage-account-tests
$ az storage account create --name 'account2rg2rg2r62r' --resource-group 'storage-account-tests' --allow-shared-key-access false --access-tier Hot | jq '.allowSharedKeyAccess'
# Access key-based access not allowed
false
Run ScoutSuite with default parameters:
scout azure --cli
The report will incorrectly flag account2rg2rg2r62r
as having never rotated its access key, despite the storage account not even supporting access keys:
Additional context
n/a