VIEW RULE IN DATADOG

Description

An Azure service principal can generate an account or service shared access signature for a storage account that contains a crown jewel blob container, and the storage account permits Shared Key authorization. If the principal is compromised, an attacker could mint a SAS token and use it to access business-critical data.

Remediation

1. Remove role assignments that grant the service principal account or service SAS generation permissions. See Remove Azure role assignments.
2. Disallow Shared Key authorization on the storage account after verifying that clients will continue to work as intended. See Prevent Shared Key authorization.