Storage account Queue services should have classic logging enabled
This control ensures that classic logging is enabled for the Azure Queue service. It validates whether operations such as enqueue, dequeue, and delete are being captured via the legacy storage logging mechanism.
This is especially relevant for older deployments where diagnostic settings are not configured.
What this control checks
Queue service classic logging captures read, write and delete requests.
Common pitfalls
queue_properties does not apply to other account kinds
The queue_properties block doesn't apply for other account kind. The check passes when account_kind is not Storage or StorageV2.
delete, write and read must all be set
delete, write and read must all be set.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.storage_account_queue_service_classic_logging_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_33.
Framework-specific interpretation
CIS Azure Benchmark v1.3.0: Mapped to 3.3 (Ensure Storage logging is enabled for Queue service for read, write, and delete requests).
CIS Azure Benchmark v1.4.0: Mapped to 3.3 (Ensure Storage logging is enabled for Queue service for 'Read', 'Write', and 'Delete' requests).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.3 Ensure Storage logging is enabled for Queue service for read, write, and delete requests
- 3.3 Ensure Storage logging is enabled for Queue service for 'Read', 'Write', and 'Delete' requests
Related controls
- Storage accounts should have soft delete enabled for both blobs and containers
- Storage accounts should use customer-managed key for encryption
- Storage accounts should use Azure Resource Manager resources
- Network security groups should have Diagnostic Settings configured
- SMB file shares should have 'SMB channel encryption' set to 'AES-256-GCM' or higher
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_queue_service_classic_logging_enabled - Checkov Check:
CKV_AZURE_33 - Powerpipe Control:
azure_compliance.control.storage_account_queue_service_classic_logging_enabled
Last reviewed: 2026-10-15