Add rule for Azure Storage HTTPS enforcement (AZ-STORAGE-HTTPS-001)

[Ablaze005]

Rule Details

• Rule ID:AZ-STORAGE-HTTPS-001
• Severity: HIGH
• Category: Storage
• Frameworks: CIS / NIST / ISO 27001 / SOC 2

What does it detect?

This rule detects Azure Storage Accounts that do not enforce HTTPS-only traffic.
-It flags:
*Storage Accounts where supportsHttpsTrafficOnly is false
*Storage Accounts where the property is missing

Detection logic

• Query Storage Accounts:
  Microsoft.Storage/storageAccounts

• Read the property:
  properties.supportsHttpsTrafficOnly

• If the value is:
  *false
  *null
  → return a HIGH severity finding.

• If the value is true → pass.

Why is this a security risk?

• Allowing HTTP traffic exposes Storage Accounts to:

*Man-in-the-middle attacks
*Unencrypted data exposure
*Compliance violations

HTTPS-only is required by:

CIS Azure Foundations Benchmark
*NIST 800-53
*ISO 27001
*SOC 2

Remediation steps

az storage account update
--name
--resource-group
--https-only true

Test plan

-[ ] Tested against real Azure free trial subscription

• Compliant case (HTTPS-only enabled) returns no findings
• Non-compliant case returns correct HIGH severity finding
• CLI playbook written and tested
• All four compliance framework JSONs updated