Storage account must use TLS 1.2 minimum

High Azure General storage-min-tls

Applies to

Microsoft.Storage/storageAccounts

What CGPulse checks

A resource passes this rule when minimumTlsVersion must be one of ["TLS1_2","TLS1_3"]. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Set minimum TLS version to 1.2 to prevent protocol downgrade attacks. In Azure Portal: Storage account > Configuration > set Minimum TLS version to 1.2. See: https://learn.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version

CLI

az storage account update --ids "{id}" --min-tls-version TLS1_2

Terraform

resource "azurerm_storage_account" "{name}" {
  name                      = "{name}"
  resource_group_name       = "{rg}"
  location                  = var.location
  account_tier              = "Standard"
  account_replication_type  = "LRS"
  min_tls_version           = "TLS1_2"
}

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan