Blob service should enable soft delete

High Azure General blob-soft-delete

Applies to

Microsoft.Storage/storageAccounts/blobServices

What CGPulse checks

A resource passes this rule when deleteRetentionEnabled must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable soft delete to allow recovery of accidentally deleted blobs. In Azure Portal: Storage account > Data protection > enable Soft delete for blobs. See: https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-overview

CLI

az storage account blob-service-properties update --ids "{id}" --enable-delete-retention true --delete-retention-days 7

Bicep

resource storageAccount 'Microsoft.Storage/storageAccounts@2023-05-01' existing = {{
  name: '{parentName}'
}}
resource blobServices 'Microsoft.Storage/storageAccounts/blobServices@2023-05-01' = {{
  parent: storageAccount
  name: 'default'
  properties: {{
    deleteRetentionPolicy: {{
      enabled: true
      days: 7
    }}
  }}
}}

Terraform

resource "azurerm_storage_account" "{name}" {
  name                     = "{parentName}"
  resource_group_name      = "{rg}"
  location                 = var.location
  account_tier             = "Standard"
  account_replication_type = "LRS"

  blob_properties {
    delete_retention_policy {
      days = 7
    }
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan