Back to Checks
azure

Storage account uses AES-256-GCM for SMB channel encryption on file shares

storage_smb_channel_encryption_with_secure_algorithm
Service: storageSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.storage/storageaccounts

Azure Storage file shares (SMB) are evaluated for SMB channel encryption and whether the allowed ciphers include the recommended AES-256-GCM.

This identifies if encryption is configured and a secure algorithm is present in the SMB settings for file shares within the storage account.

Prowler logoProwlerprowler-provider-azure

Risk

Missing or weak SMB channel encryption undermines confidentiality and integrity. On-path attackers could read sensitive files, capture hashes, or modify data in transit. Allowing legacy ciphers increases downgrade risks and can facilitate lateral movement, eroding trust boundaries across networks.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_smb_channel_encryption_with_secure_algorithm

Recommendation

Enforce defense in depth by restricting SMB channel encryption to AES-256-GCM on SMB 3.1.1, removing weaker options.

  • Prefer private access (private endpoints/VPN)
  • Require secure transfer and modern TLS
  • Apply least privilege on shares
  • Validate client support and monitor connections during rollout

Remediation

CLI

az storage account file-service-properties update --resource-group <resource-group> --account-name <storage-account> --channel-encryption AES-256-GCM

Terraform

# Set SMB channel encryption to AES-256-GCM on the storage account
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<example_location>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  share_properties {
    smb {
      channel_encryption_type = "AES256_GCM" # CRITICAL: Enables AES-256-GCM for SMB channel encryption
    }
  }
}

NativeIaC

// Bicep: enforce AES-256-GCM for SMB channel encryption on the storage account's File Service
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' existing = {
  name: '<example_resource_name>'
}

resource fileService 'Microsoft.Storage/storageAccounts/fileServices@2023-01-01' = {
  name: 'default'
  parent: sa
  properties: {
    protocolSettings: {
      smb: {
        channelEncryption: [ 'AES-256-GCM' ] // CRITICAL: Allows AES-256-GCM for SMB channel encryption to pass the check
      }
    }
  }
}

Other

1In the Azure portal, open your storage account
2Go to Data storage > File shares
3Under File share settings, click Security
4Select Custom
5Under SMB channel encryption, select AES-256-GCM
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client

DEFAULT_SECURE_ENCRYPTION_ALGORITHMS = ["AES-256-GCM"]


class storage_smb_channel_encryption_with_secure_algorithm(Check):
    """
    Ensure SMB channel encryption for file shares only allows secure algorithms (AES-256-GCM or higher by default).

    The list of allowed algorithms is configurable via
    azure.recommended_smb_channel_encryption_algorithms in the Prowler configuration file.

    This check evaluates whether SMB file shares are configured to use only the recommended SMB channel encryption algorithms.
    - PASS: Storage account only allows secure SMB channel encryption algorithms for file shares.
    - FAIL: Storage account does not have SMB channel encryption enabled, or it allows at least one algorithm that is not in the recommended list.
    """

    def execute(self) -> list[Check_Report_Azure]:
        findings = []
        secure_encryption_algorithms = storage_client.audit_config.get(
            "recommended_smb_channel_encryption_algorithms",
            DEFAULT_SECURE_ENCRYPTION_ALGORITHMS,
        )
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for account in storage_accounts:
                if account.file_service_properties:
                    channel_encryption = (
                        account.file_service_properties.smb_protocol_settings.channel_encryption
                    )
                    pretty_current_algorithms = (
                        ", ".join(channel_encryption) if channel_encryption else "none"
                    )
                    report = Check_Report_Azure(
                        metadata=self.metadata(),
                        resource=account.file_service_properties,
                    )
                    report.subscription = subscription
                    report.resource_name = account.name

                    if not channel_encryption:
                        report.status = "FAIL"
                        report.status_extended = f"Storage account {account.name} from subscription {subscription_name} ({subscription}) does not have SMB channel encryption enabled for file shares."
                    elif all(
                        algorithm in secure_encryption_algorithms
                        for algorithm in channel_encryption
                    ):
                        report.status = "PASS"
                        report.status_extended = f"Storage account {account.name} from subscription {subscription_name} ({subscription}) only allows secure algorithms for SMB channel encryption on file shares since it supports {pretty_current_algorithms}."
                    else:
                        report.status = "FAIL"
                        report.status_extended = f"Storage account {account.name} from subscription {subscription_name} ({subscription}) allows insecure algorithms for SMB channel encryption on file shares since it supports {pretty_current_algorithms} and only {', '.join(secure_encryption_algorithms)} is recommended."

                    findings.append(report)
        return findings

References