Blob service should enable versioning

Medium Azure General blob-versioning

Applies to

Microsoft.Storage/storageAccounts/blobServices

What CGPulse checks

A resource passes this rule when isVersioningEnabled must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable blob versioning to maintain previous versions for data recovery. In Azure Portal: Storage account > Data protection > enable Versioning for blobs. See: https://learn.microsoft.com/en-us/azure/storage/blobs/versioning-overview

CLI

az storage account blob-service-properties update --ids "{id}" --enable-versioning true

Bicep

resource storageAccount 'Microsoft.Storage/storageAccounts@2023-05-01' existing = {{
  name: '{parentName}'
}}
resource blobServices 'Microsoft.Storage/storageAccounts/blobServices@2023-05-01' = {{
  parent: storageAccount
  name: 'default'
  properties: {{
    isVersioningEnabled: true
  }}
}}

Terraform

resource "azurerm_storage_account" "{name}" {
  name                     = "{parentName}"
  resource_group_name      = "{rg}"
  location                 = var.location
  account_tier             = "Standard"
  account_replication_type = "LRS"

  blob_properties {
    versioning_enabled = true
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan