Back to Checks
azure

Storage account has secure transfer required enabled

storage_secure_transfer_required_is_enabled
Service: storageSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.storage/storageaccounts

Azure Storage accounts are evaluated for secure transfer enforcement, requiring all client requests to use HTTPS only (enableHttpsTrafficOnly) and blocking HTTP.

Prowler logoProwlerprowler-provider-azure

Risk

Allowing HTTP to storage endpoints enables man-in-the-middle and TLS-stripping attacks. Intercepted traffic can expose credentials, SAS tokens, or data (confidentiality) and allow request tampering (integrity), leading to unauthorized access and data exfiltration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_secure_transfer_required_is_enabled

Recommendation

Enforce HTTPS-only on all storage accounts (enableHttpsTrafficOnly) and use modern TLS. Apply least privilege to SAS and keys, rotate if exposure is suspected, and use defense in depth: prefer private endpoints, restrict public access, block HTTP at network controls, and ensure all clients use https:// endpoints.

Remediation

CLI

az storage account update -g <RESOURCE_GROUP> -n <STORAGE_ACCOUNT_NAME> --https-only true

Terraform

# Enable secure transfer (HTTPS only) on a Storage Account
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<location>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  enable_https_traffic_only = true # Critical: require HTTPS-only (secure transfer)
}

NativeIaC

// Enable secure transfer (HTTPS only) on a Storage Account
resource <example_resource_name> 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  sku: { name: 'Standard_LRS' }
  kind: 'StorageV2'
  properties: {
    supportsHttpsTrafficOnly: true // Critical: require HTTPS-only (secure transfer)
  }
}

Other

1In Azure Portal, go to Storage accounts and select the account
2Under Settings, open Configuration
3Set Secure transfer required to Enabled
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_secure_transfer_required_is_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for storage_account in storage_accounts:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=storage_account
                )
                report.subscription = subscription
                report.status = "PASS"
                report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has secure transfer required enabled."
                if not storage_account.enable_https_traffic_only:
                    report.status = "FAIL"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has secure transfer required disabled."

                findings.append(report)

        return findings

References