Back to Checks
azure

Storage account has infrastructure encryption enabled

storage_infrastructure_encryption_is_enabled
Service: storageSeverity: low
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.storage/storageaccounts

Azure Storage accounts have infrastructure encryption enabled, providing double encryption at rest alongside service-level encryption (requireInfrastructureEncryption=true).

Prowler logoProwlerprowler-provider-azure

Risk

Without this second layer, compromise of the service-level key or algorithm can expose stored data, degrading confidentiality and weakening defense in depth. Insider misuse or key theft is more likely to yield readable blobs, files, or tables.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_infrastructure_encryption_is_enabled

Recommendation

Enable infrastructure encryption for accounts or scopes handling sensitive data to strengthen defense in depth. Plan it at creation, as the setting is immutable. Maintain strong key hygiene for service-level encryption (use CMK where appropriate, rotate, restrict access) and enforce guardrails with policy.

Remediation

Terraform

# Storage account with infrastructure encryption enabled
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<location>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  infrastructure_encryption_enabled = true # Critical: enables infrastructure-level encryption (double encryption)
}

NativeIaC

// Storage account with infrastructure encryption enabled
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
  properties: {
    encryption: {
      keySource: 'Microsoft.Storage'
      requireInfrastructureEncryption: true // Critical: enables infrastructure-level encryption (double encryption)
    }
  }
}

Other

1In Azure Portal, go to Storage accounts and click Create
2Choose a supported type (StorageV2 or a premium blob/page/file account)
3Open the Encryption tab and set Enable infrastructure encryption to Enabled
4Click Review + create, then Create
5Migrate data from the old account to this new account and decommission the old one (infrastructure encryption cannot be enabled on existing accounts)

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_infrastructure_encryption_is_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for storage_account in storage_accounts:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=storage_account
                )
                report.subscription = subscription
                report.status = "PASS"
                report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has infrastructure encryption enabled."
                if not storage_account.infrastructure_encryption:
                    report.status = "FAIL"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has infrastructure encryption disabled."

                findings.append(report)

        return findings

References