Subscribe to access key rotation alert for storage account?

ScottM 331 Reputation points
2020-11-09T22:06:12.947+00:00

Is it possible to setup an alert so that I get notified when the access key rotates for a given azure storage account?

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,813 questions
Azure Storage Accounts
Azure Storage Accounts
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
2,717 questions
0 comments
Accepted answer
  1. Sumarigo-MSFT 43,801 Reputation points Microsoft Employee
    2020-11-10T07:05:21.51+00:00

    @ScottM You can perform this option using Logic Apps: Please refer to this blog it will provide complete details on your scenario.

    Microsoft recommends that you use Azure Key Vault to manage your access keys, and that you regularly rotate and regenerate your keys. Using the Azure Key Vault makes it easy to rotate your keys without interruption to your applications. You can also manually rotate your keys.

    Microsoft recommends that you rotate your access keys periodically to help keep your storage account secure. If possible, use the Azure Key Vault to manage your access keys. If you are not using Key Vault, you will need to rotate your keys manually.

    Note: Microsoft recommends using only one of the keys in all of your applications at the same time. If you use Key 1 in some places and Key 2 in others, you will not be able to rotate your keys without some application losing access.

    To rotate an account's access keys, the user must either be a Service Administrator or must be assigned an Azure role that includes the Microsoft.Storage/storageAccounts/regeneratekey/action. Some Azure built-in roles that include this action are the Owner, Contributor, and Storage Account Key Operator Service Role roles. For more information about the Service Administrator role, see Classic subscription administrator roles, Azure roles, and Azure AD roles. For detailed information about Azure built-in roles for Azure Storage, see the Storage section in Azure built-in roles for Azure RBAC.

    Disclaimer: This response contains a reference to a third-party World Wide Web site.
    Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites; therefore, Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there.
    There are inherent dangers in the use of any software found on the Internet, and Microsoft cautions you to make sure that you completely understand the risk before retrieving any software from the Internet.

    Hope this helps!

    Kindly let us know if the above helps or you need further assistance on this issue.

    ----------------------------------------------------------------------------------------------

    Please don’t forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    1 person found this answer helpful.
    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. ScottM 331 Reputation points
    2020-11-10T14:50:33.583+00:00

    Hi Sumarigo,

    In this case, Had a server with a backup drive mounted against an azure storage / file share. I think the storage account access keys may have changed on the storage account which then subsequently broke backups on the windows server. It would be nice to have an azure alert for when the storage account keys change so we can take proactive measures rather than wait for backups to fail.

    0 comments