Skip to main content

Azure Audit Storageaccount Secure Transport Not Enforced Fix

Triage and Remediation​

Remediation​

Using Console

To remediate the "Secure Transfer (HTTPS) Not Enforced" misconfiguration in Azure, follow these steps:

  1. Log in to the Azure portal.

  2. Navigate to the storage account that needs to be remediated.

  3. Click on the "Firewalls and virtual networks" tab.

  4. Ensure that "Allow access from" is set to "Selected networks".

  5. Click on the "Selected networks" tab and ensure that "All networks" is not selected.

  6. Add the IP addresses or ranges that need to access the storage account.

  7. Click on the "Secure transfer required" toggle switch to enable HTTPS.

  8. Click on the "Save" button to save the changes.

  9. Verify that HTTPS is enforced by attempting to access the storage account using HTTP. Access should be denied.

By following these steps, you can remediate the "Secure Transfer (HTTPS) Not Enforced" misconfiguration in Azure.

Using CLI

To remediate the "Secure Transfer (HTTPS) Not Enforced" misconfiguration for an Azure resource using Azure CLI, follow these steps:

  1. Open the Azure CLI and log in to your Azure account.

  2. Identify the resource for which HTTPS is not enforced.

  3. Run the following command to enable HTTPS for the identified resource:

az webapp update --name <app_name> --resource-group <resource_group_name> --set httpsOnly=true

  1. Replace <app_name> with the name of the app for which you want to enforce HTTPS.

  2. Replace <resource_group_name> with the name of the resource group that contains the app.

  3. After running the command, Azure CLI will return the updated configuration of the app.

  4. Verify that HTTPS is now enforced by accessing the app's URL using HTTPS.

By following these steps, you can remediate the "Secure Transfer (HTTPS) Not Enforced" misconfiguration for an Azure resource using Azure CLI.

Using Python

To remediate the misconfiguration "Secure Transfer (HTTPS) Not Enforced" for Azure using Python, you can follow these steps:

  1. Install the Azure SDK for Python using pip. You can install it by running the following command in your terminal:
pip install azure
  1. Use the Azure Python SDK to create an HTTPS-only endpoint for your web app. You can do this by running the following code:
from azure.mgmt.web import WebSiteManagementClient
from azure.common.credentials import ServicePrincipalCredentials

# Replace with your own subscription ID, resource group name, and web app name
subscription_id = 'your-subscription-id'
resource_group_name = 'your-resource-group-name'
web_app_name = 'your-web-app-name'

# Replace with your own service principal details
tenant_id = 'your-tenant-id'
client_id = 'your-client-id'
client_secret = 'your-client-secret'

# Authenticate using a service principal
credentials = ServicePrincipalCredentials(
    client_id=client_id,
    secret=client_secret,
    tenant=tenant_id
)

# Create a web site management client
web_client = WebSiteManagementClient(credentials, subscription_id)

# Get the web app configuration
web_app_config = web_client.web_apps.get_configuration(resource_group_name, web_app_name)

# Update the web app configuration to use HTTPS only
web_app_config.http20_enabled = True
web_app_config.min_tls_version = '1.2'
web_client.web_apps.update_configuration(resource_group_name, web_app_name, web_app_config)
  1. Run the code to update your web app configuration and enforce HTTPS. Once the code has executed successfully, your web app will only be accessible over HTTPS, ensuring that all data is transferred securely.

Note: This code assumes that you have already created a web app in Azure and have the necessary permissions to modify its configuration. If you need to create a new web app, you can use the Azure Python SDK to create one programmatically.

Using Terraform
resource "azurerm_storage_account" "THIS_STORAGE_ACCOUNT" {
  name                     = "STORAGE_ACCOUNT_NAME"        # substitute your storage account name
  resource_group_name      = "RESOURCE_GROUP_NAME"         # substitute your resource group
  location                 = "AZURE_REGION"                # e.g. "eastus"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  # Enforce secure transfer (HTTPS) for all requests
  enable_https_traffic_only = true
}

This change does not force replacement; Terraform will update the existing storage account in place.

For verification, terraform plan should show a change from enable_https_traffic_only = false (or null) to true on the azurerm_storage_account resource.