Ensure Azure Security Center Defender is set to On for storage

Error: Azure Security Center Defender is set to Off for storage

Bridgecrew Policy ID: BC_AZR_GENERAL_61
Checkov Check ID: CKV_AZURE_84
Severity: MEDIUM

Azure Security Center Defender is set to Off for storage

Description

Azure Defender is a cloud workload protection service that utilizes and agent-based deployment to analyze signals from Azure network fabric and the service control plane, to detect threats across all Azure resources. It can also analyze non-Azure resources, utilizing Azure Arc, including those on-premises and in both AWS and GCP (once they've been onboarded).

Azure Defender for Storage detects unusual and potentially harmful attempts to access or exploit storage accounts.

Fix - Buildtime

Terraform

  • Resource: azurerm_security_center_subscription_pricing
  • Argument: resource_type - (Required) The resource type this setting affects. Ensure that StorageAccounts is declared to pass this check.
resource "azurerm_security_center_subscription_pricing" "example" {
  tier          = "Standard"
  resource_type = "AppServices,ContainerRegistry,KeyVaults,KubernetesService,SqlServers,SqlServerVirtualMachines,StorageAccounts,VirtualMachines,ARM,DNS"
}