Back to Checks
azure

Storage account minimum TLS version is 1.2

storage_ensure_minimum_tls_version_12
Service: storageSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.storage/storageaccounts

Azure Storage accounts enforce a minimum TLS version of 1.2 for client connections to data services

Prowler logoProwlerprowler-provider-azure

Risk

Allowing TLS 1.0/1.1 enables protocol downgrades and exploitation of known flaws (e.g., BEAST), weakening confidentiality and integrity. Attackers can intercept or modify data in transit and harvest credentials via weakened cipher suites.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_ensure_minimum_tls_version_12

Recommendation

Set the storage account minimum TLS version to at least 1.2 (prefer 1.3 where supported) and disable legacy protocols. Apply defense in depth by restricting network access, using least privilege credentials, and monitoring handshake failures to identify outdated clients.

Remediation

CLI

az storage account update --resource-group <RESOURCE_GROUP> --name <STORAGE_ACCOUNT_NAME> --min-tls-version TLS1_2

Terraform

# Storage account with minimum TLS 1.2
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<example_location>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  min_tls_version = "TLS1_2" # CRITICAL: Enforces minimum TLS 1.2 to pass the check
}

NativeIaC

// Storage account with minimum TLS 1.2
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  kind: 'StorageV2'
  sku: {
    name: 'Standard_LRS'
  }
  properties: {
    minimumTlsVersion: 'TLS1_2' // CRITICAL: Enforces minimum TLS 1.2 to pass the check
  }
}

Other

1In the Azure Portal, go to Storage accounts and open your account
2Select Settings > Configuration
3Set Minimum TLS version to Version 1.2
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_ensure_minimum_tls_version_12(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for storage_account in storage_accounts:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=storage_account
                )
                report.subscription = subscription
                report.status = "PASS"
                report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has TLS version set to 1.2."

                if storage_account.minimum_tls_version != "TLS1_2":
                    report.status = "FAIL"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) does not have TLS version set to 1.2."

                findings.append(report)

        return findings

References