Storage accounts should have shared key access disabled
Examines the shared key access setting on storage accounts, which should be disabled. With shared key access turned off, the account requires identity-based access through Microsoft Entra ID and `RBAC` instead of account keys.
A leaked key grants broad read/write/delete across the account. Access bypasses RBAC and Conditional Access, reducing accountability. Activity is hard to attribute, easing data exfiltration and tampering.
What this control checks
Fails when shared_access_key_enabled is true or unset
Common pitfalls
Missing shared_access_key_enabled defaults to true
# missing "shared_access_key_enabled" (defaults to true)
Value is not set to false
shared_access_key_enabled = true # value is not set to false
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Storage accounts should prevent shared key access" (8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54); Prowler check storage_account_key_access_disabled (prowler azure --checks storage_account_key_access_disabled); PowerPipe control azure_compliance.control.storage_account_shared_key_access_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_AZURE_40; KICS query "Beta - Storage Account With Shared Access Key" (45f3e879-f8a7-4102-a3fa-46da5a849870).
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 10.3.1.3 (Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled').
CIS Azure Benchmark v5.0.0: Mapped to 9.3.1.3 (Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled').
BSI C5:2025: Mapped to IAM-10.01B (The cloud service provider ensures that access to its internal data and system functions is controlled and restricted...), IAM-10.02B (The cloud service provider establishes processes and technical controls to manage and verify access permissions within...) and PS-03.02B (The security measures are designed to detect and prevent unauthorised access so that the information security of the...).
Framework mappings
The clauses this control is mapped to in each framework.
- 10.3.1.3 Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled'
- 9.3.1.3 Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled'
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_shared_key_access_disabled - Checkov Check:
CKV2_AZURE_40 - Powerpipe Control:
azure_compliance.control.storage_account_shared_key_access_disabled - Prowler Check:
storage_account_key_access_disabled - Azure Policy Definition:
8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54 - KICS Query:
45f3e879-f8a7-4102-a3fa-46da5a849870
Last reviewed: 2026-10-15