Back to Checks
azure

Azure Storage account uses geo-redundant replication (GRS, GZRS, RA-GRS, or RA-GZRS)

storage_geo_redundant_enabled
Service: storageSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:microsoft.storage/storageaccounts

Azure Storage accounts configured for geo-redundant replication via Standard_GRS, Standard_GZRS, Standard_RAGRS, or Standard_RAGZRS.

The setting indicates data is copied to a paired secondary region, with RA-* allowing read access during primary-region unavailability.

Prowler logoProwlerprowler-provider-azure

Risk

Absent geo-replication, data resides in one region, undermining availability and durability during regional failures. Disasters can cause prolonged downtime or unrecoverable loss. With geo-replication but without RA-*, the secondary is unreadable, increasing RTO and interrupting business continuity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_geo_redundant_enabled

Recommendation

Adopt GRS/GZRS for critical workloads (prefer Standard_GZRS where supported) to achieve cross-region resilience. If read continuity is required, use Standard_RAGRS or Standard_RAGZRS. Define RPO/RTO, regularly test failover, and design for defense in depth across regions and zones.

Remediation

CLI

az storage account update --name <storage-account-name> --resource-group <resource-group-name> --sku Standard_GRS

Terraform

resource "azurerm_storage_account" "example" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_group_name>"
  location                 = "<example_location>"
  account_tier             = "Standard"
  account_replication_type = "GRS" # Critical: enables geo-redundant replication to pass the check
}

NativeIaC

// Storage account with geo-redundant replication enabled
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: '<example_location>'
  kind: 'StorageV2'
  sku: {
    name: 'Standard_GRS' // Critical: enables geo-redundant replication (GRS) to pass the check
  }
}

Other

1In the Azure portal, go to Storage accounts and open your storage account
2Under Data management, select Redundancy
3Change Redundancy to GRS, GZRS, RA-GRS, or RA-GZRS
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_geo_redundant_enabled(Check):
    """Check if geo-redundant storage (GRS) is enabled on critical Azure Storage Accounts.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> Check_Report_Azure:
        """Execute the check for geo-redundant storage (GRS).

        This method checks if geo-redundant storage (GRS) is enabled on critical Azure Storage Accounts.

        Returns:
            Check_Report_Azure: A report containing the result of the check.
        """
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for storage_account in storage_accounts:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=storage_account
                )
                report.subscription = subscription

                if (
                    storage_account.replication_settings == "Standard_GRS"
                    or storage_account.replication_settings == "Standard_GZRS"
                    or storage_account.replication_settings == "Standard_RAGRS"
                    or storage_account.replication_settings == "Standard_RAGZRS"
                ):
                    report.status = "PASS"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has Geo-redundant storage {storage_account.replication_settings} enabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) does not have Geo-redundant storage enabled, it has {storage_account.replication_settings} instead."

                findings.append(report)

        return findings

References