Azure Storage accounts configured to accept TLS 1.0 and TLS 1.1 connections are vulnerable to protocol downgrade attacks, man-in-the-middle attacks, and cryptographic weaknesses. These legacy TLS versions contain known security flaws that can expose data in transit between clients and storage endpoints.
# VULNERABLE: Storage account without minimum TLS version
resource "azurerm_storage_account" "vulnerable_storage" {
name = "vulnerablestorage123"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
account_tier = "Standard"
account_replication_type = "LRS"
# VULNERABLE: No min_tls_version set (accepts TLS 1.0/1.1)
}
# VULNERABLE: Explicitly allowing TLS 1.0
resource "azurerm_storage_account" "legacy_tls" {
name = "legacytls123"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
account_tier = "Standard"
account_replication_type = "GRS"
# VULNERABLE: TLS 1.0 allows weak cryptography
min_tls_version = "TLS1_0"
}
# VULNERABLE: TLS 1.1 still vulnerable
resource "azurerm_storage_account" "tls11_storage" {
name = "tls11storage123"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
account_tier = "Standard"
account_replication_type = "LRS"
# VULNERABLE: TLS 1.1 has known weaknesses
min_tls_version = "TLS1_1"
}# SECURE: Storage account with minimum TLS 1.2
resource "azurerm_storage_account" "secure_storage" {
name = "securestorage123"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
account_tier = "Standard"
account_replication_type = "GRS"
# SECURE: Enforce TLS 1.2 minimum
min_tls_version = "TLS1_2"
enable_https_traffic_only = true
}
# SECURE: Storage account with comprehensive security
resource "azurerm_storage_account" "hardened_storage" {
name = "hardenedstorage123"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
account_tier = "Standard"
account_replication_type = "GRS"
# SECURE: TLS 1.2 and HTTPS only
min_tls_version = "TLS1_2"
enable_https_traffic_only = true
# SECURE: Additional security settings
allow_blob_public_access = false
network_rules {
default_action = "Deny"
bypass = ["AzureServices"]
}
}The vulnerable configurations either omit min_tls_version (accepting any TLS version including 1.0/1.1) or explicitly set it to TLS1_0 or TLS1_1, which have known cryptographic weaknesses and are susceptible to protocol downgrade attacks. The secure version enforces min_tls_version of TLS1_2, combined with enable_https_traffic_only to ensure all connections use modern, secure cryptographic protocols.
Azure Storage accounts created without explicitly setting min_tls_version in Terraform. Without this parameter, storage accounts may accept connections using legacy TLS 1.0 and 1.1 protocols with known cryptographic vulnerabilities.
Sourcery automatically identifies information disclosure from outdated tls versions in azure storage account and many other security issues in your codebase.