Detections
Analytics
9.3.11 Ensure Redundancy is Set to 'geo-redundant storage (GRS)' on Critical Azure Storage Accounts
Information
Geo-redundant storage (GRS) in Azure replicates data three times within the primary region using locally redundant storage (LRS) and asynchronously copies it to a secondary region hundreds of miles away. This setup ensures high availability and resilience by providing 16 nines (99.99999999999999%) durability over a year, safeguarding data against regional outages.Enabling GRS protects critical data from regional failures by maintaining a copy in a geographically separate location. This significantly reduces the risk of data loss, supports business continuity, and meets high availability requirements for disaster recovery.
NOTE: In recent discussions the CIS Microsoft Azure Community has discussed revising this recommendation to ensure other geographically redundant storage options are considered. While the recommendation remains unchanged in this publication, other Geographically redundant settings (RA-GRS, GZRS, RA-GZRS) should be considered legitimate alternatives.
Solution
Remediate from Azure Portal- Go to Storage accounts.
- Click on a storage account.
- Under Data management, click Redundancy.
- From the Redundancy drop-down menu, select Geo-redundant storage (GRS).
- Click Save.
- Repeat steps 1-5 for each storage account requiring remediation.
Remediate from Azure CLI
For each storage account requiring remediation, run the following command to enable geo-redundant storage:
az storage account update --resource-group <resource-group> --name <storage-account> --sku Standard_GRS
Remediate from PowerShell
For each storage account requiring remediation, run the following command to enable geo-redundant storage:
Set-AzStorageAccount -ResourceGroupName <resource-group> -Name <storage-account> -SkuName "Standard_GRS"
Impact:
Enabling geo-redundant storage on Azure storage accounts increases costs due to cross-region data replication.
See Also
Item Details
Audit Name: CIS Microsoft Azure Foundations v6.0.0 L2
Category: CONTINGENCY PLANNING
References: 800-53|CP-2, 800-53|CP-10, CSCv7|10
Plugin: microsoft_azure
Control ID: 97dc30be4d8159b986cf6df1bee592bf04aceb860675a4dc2da498111dd08df0