Back to Checks
azure

Storage account has shared key access disabled

storage_account_key_access_disabled
Service: storageSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesssecrets
Resource Type:microsoft.storage/storageaccounts

Azure Storage accounts are evaluated for whether Shared Key (account key) authorization is disabled, requiring identity-based access via Microsoft Entra ID and RBAC.

Prowler logoProwlerprowler-provider-azure

Risk

Allowing Shared Key undermines confidentiality, integrity, and availability:

  • A leaked key grants broad read/write/delete across the account
  • Access bypasses RBAC and Conditional Access, reducing accountability
  • Activity is hard to attribute, easing data exfiltration and tampering

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_account_key_access_disabled

Recommendation

Disallow Shared Key and require Microsoft Entra ID with least-privilege RBAC for all data access.

  • Prefer user delegation SAS over account/service SAS
  • Apply Conditional Access and separation of duties
  • Monitor and phase out key-based clients; rotate and revoke unused keys

Remediation

CLI

az storage account update --name <storage-account-name> --resource-group <resource-group> --allow-shared-key-access false

Terraform

resource "azurerm_storage_account" "main" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<example_resource_name>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  shared_access_key_enabled = false # Critical: disables Shared Key authorization to pass the check
}

NativeIaC

// Storage account with Shared Key access disabled
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  kind: 'StorageV2'
  sku: { name: 'Standard_LRS' }
  properties: {
    allowSharedKeyAccess: false // Critical: disallows Shared Key authorization to pass the check
  }
}

Other

1In the Azure portal, open the target Storage account
2Go to Settings > Configuration
3Set "Allow storage account key access" to "Disabled"
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_account_key_access_disabled(Check):
    """Check if storage account key access is disabled.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> Check_Report_Azure:
        """Execute the check for storage account key access.

        This method checks if storage account key access is disabled. If it is, the check passes; otherwise, it fails.

        Returns:
            Check_Report_Azure: A report containing the result of the check.
        """
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for storage_account in storage_accounts:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=storage_account
                )
                report.subscription = subscription
                if not storage_account.allow_shared_key_access:
                    report.status = "PASS"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has shared key access disabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has shared key access enabled."
                findings.append(report)
        return findings

References