Storage Account access keys should be periodically regenerated

azure.storage

Description

Regenerate Storage Account access keys at least every 90 days so that a leaked key has a bounded lifetime. Azure generates two 512-bit access keys (key1 and key2) per account, and both should have been regenerated within the last 90 days.

This rule passes when both access keys were last regenerated within the past 90 days. Accounts whose key creation timestamps are unavailable fail, since key rotation cannot be confirmed without them.

Remediation

Regenerate any access key that has not been rotated in the last 90 days, and configure a key expiration policy to automate rotation reminders. See Manually rotate access keys and Create a key expiration policy.