diff --git a/ScoutSuite/output/data/html/partials/azure/services.storageaccounts.subscriptions.id.storage_accounts.html b/ScoutSuite/output/data/html/partials/azure/services.storageaccounts.subscriptions.id.storage_accounts.html index 4d1352845..d39754fa7 100755 --- a/ScoutSuite/output/data/html/partials/azure/services.storageaccounts.subscriptions.id.storage_accounts.html +++ b/ScoutSuite/output/data/html/partials/azure/services.storageaccounts.subscriptions.id.storage_accounts.html @@ -10,6 +10,7 @@

Information

Public Traffic: {{convert_bool_to_enabled public_traffic_allowed }}
HTTPS Required: {{convert_bool_to_enabled https_traffic_enabled}}
Microsoft Trusted Services: {{convert_bool_to_enabled trusted_microsoft_services_enabled }}
+
Access Key Usage: {{convert_bool_to_enabled shared_key_access_allowed}}
Last Access Key Rotation: {{#if access_keys_last_rotation_date }} diff --git a/ScoutSuite/providers/azure/resources/storageaccounts/storage_accounts.py b/ScoutSuite/providers/azure/resources/storageaccounts/storage_accounts.py index 83812511c..855c535df 100755 --- a/ScoutSuite/providers/azure/resources/storageaccounts/storage_accounts.py +++ b/ScoutSuite/providers/azure/resources/storageaccounts/storage_accounts.py @@ -45,6 +45,8 @@ def _parse_storage_account(self, raw_storage_account): storage_account['trusted_microsoft_services_enabled'] = \ self._is_trusted_microsoft_services_enabled(raw_storage_account) storage_account['bypass'] = raw_storage_account.network_rule_set.bypass + # The default value (null) is equivalent to True + storage_account['shared_key_access_allowed'] = raw_storage_account.allow_shared_key_access != False storage_account['access_keys_last_rotation_date'] = \ self._parse_access_keys_last_rotation_date(raw_storage_account.activity_logs) storage_account['encryption_key_source'] = raw_storage_account.encryption.key_source diff --git a/ScoutSuite/providers/azure/rules/findings/storageaccount-access-keys-not-rotated.json b/ScoutSuite/providers/azure/rules/findings/storageaccount-access-keys-not-rotated.json index da580f77e..c35755525 100755 --- a/ScoutSuite/providers/azure/rules/findings/storageaccount-access-keys-not-rotated.json +++ b/ScoutSuite/providers/azure/rules/findings/storageaccount-access-keys-not-rotated.json @@ -21,18 +21,26 @@ "dashboard_name": "Storage Accounts", "path": "storageaccounts.subscriptions.id.storage_accounts.id", "conditions": [ - "or", + "and", [ - "storageaccounts.subscriptions.id.storage_accounts.id.access_keys_last_rotation_date", - "equal", - "None" + "storageaccounts.subscriptions.id.storage_accounts.id.shared_key_access_allowed", + "true", + "" ], [ - "storageaccounts.subscriptions.id.storage_accounts.id.access_keys_last_rotation_date", - "olderThan", + "or", [ - "_ARG_0_", - "days" + "storageaccounts.subscriptions.id.storage_accounts.id.access_keys_last_rotation_date", + "equal", + "None" + ], + [ + "storageaccounts.subscriptions.id.storage_accounts.id.access_keys_last_rotation_date", + "olderThan", + [ + "_ARG_0_", + "days" + ] ] ] ], diff --git a/requirements.txt b/requirements.txt index eb8c8cdda..c2041cd46 100755 --- a/requirements.txt +++ b/requirements.txt @@ -35,7 +35,7 @@ azure-identity==1.5.0 ## for resources azure-mgmt-resource==15.0.0 -azure-mgmt-storage==16.0.0 +azure-mgmt-storage==17.0.0 azure-mgmt-monitor==2.0.0 azure-mgmt-sql==1.0.0 azure-mgmt-security==1.0.0