VIEW RULE IN DATADOG

Description

An Azure service principal can list the access keys for a storage account that contains a crown jewel blob container, and the storage account permits Shared Key authorization. If the principal is compromised, an attacker could use an account key to access or alter business-critical data in the storage account.

Remediation

1. Remove role assignments that grant the service principal permission to list storage account keys. See Remove Azure role assignments.
2. Disallow Shared Key authorization and rotate the account keys after verifying that clients will continue to work as intended. See Prevent Shared Key authorization and Manage storage account access keys.