Key rotation reminders should be enabled for each Storage Account

azure.storage

Description

Enable key rotation reminders on each Storage Account by configuring a key expiration period. When keyExpirationPeriodInDays is set, Azure surfaces a reminder to rotate the account access keys before they exceed that age, reducing the window in which a leaked key remains valid.

This rule passes when the Storage Account’s key policy defines a key expiration period greater than zero.

Remediation

Set a key expiration period on the Storage Account. See Manage account access keys: Create a key expiration policy.