Storage accounts should have secure transfer enabled
Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). It protects data in transit from man-in-the-middle, eavesdropping, and session-hijacking.
Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking. Allowing HTTP to storage endpoints enables man-in-the-middle and TLS-stripping attacks. Intercepted traffic can expose credentials, SAS tokens, or data (confidentiality) and allow request tampering (integrity), leading to unauthorized access and data exfiltration.
What this control checks
Storage accounts must accept requests only from secure connections (HTTPS).
Common pitfalls
Missing attribute also fails the check
KICS flags a azurerm_storage_account with a MissingAttribute for https_traffic_only_enabled. The same applies to enable_https_traffic_only.
HTTPS alone may not satisfy the check
Storage accounts should enforce HTTPS for secure data transfer and use a minimum TLS version of 1.2 or higher.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Secure transfer to storage accounts should be enabled" (404c3081-a854-4457-ae30-26a93ef643f9) and "Configure secure transfer of data on a storage account" (f81e3117-0093-4b17-8a60-82363134f0eb); Prowler check storage_secure_transfer_required_is_enabled (prowler azure --checks storage_secure_transfer_required_is_enabled); PowerPipe control azure_compliance.control.storage_account_secure_transfer_required_enabled.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Storage Account Not Forcing HTTPS" (12944ec4-1fa0-47be-8b17-42a034f937c2); Trivy checks AZU-0008 and AZU-0059.
Framework-specific interpretation
SOC 2: Mapped to CC6.7 (The entity restricts the transmission, movement, and removal of information to authorized internal and external users...).
PCI DSS v4.0: Mapped to 1.2.5 (Network security controls (NSCs) are configured and maintained.), 2.2.5 (System components are configured and managed securely.), 2.2.7 (System components are configured and managed securely.) and 2 more clauses.
ISO/IEC 27001:2022: Mapped to A.8.12 (Data Leakage Prevention) and A.8.24 (Use of Cryptography).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.a (cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;), 12.2.2.b (provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the...), 12.2.2.c (provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.) and 3 more clauses.
NIST SP 800-53 Rev 5: Mapped to SC-8 (Transmission Confidentiality and Integrity) and SC-8(1) (Cryptographic Protection).
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-03 (Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties...), PR.AA-03 (Users, services, and hardware are authenticated.), PR.AA-04 (Identity assertions are protected, conveyed, and verified.) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- 1.2.5: Network security controls (NSCs) are configured and maintained.
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- 2.2.7: System components are configured and managed securely.
- 4.2.1: PAN is protected with strong cryptography during transmission.
- 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained
- A.8.12 Data leakage prevention
- A.8.24 Use of cryptography
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
NIST Cybersecurity Framework v2.0
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- PR.AA-03
- PR.AA-04
- PR.DS-02
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- 10.3.4 Ensure that 'Secure transfer required' is set to 'Enabled'
- 9.3.4 Ensure that 'Secure transfer required' is set to 'Enabled'
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- 3.1.h Public Key Infrastructure (PKI)
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- 3.1 Ensure that 'Secure transfer required' is set to 'Enabled'
- 3.1 Ensure that 'Secure transfer required' is set to 'Enabled'
- 3.1 Ensure that 'Secure transfer required' is set to 'Enabled'
- 3.1 Ensure that 'Secure transfer required' is set to 'Enabled'
- 3.1 Ensure that 'Secure transfer required' is set to 'Enabled'
- 4.1 Ensure that 'Secure transfer required' is set to 'Enabled'
- SC-8 Transmission Confidentiality And Integrity
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 0809.01n2Organizational.1234-01.n 01.04 Network Access Control
- 0810.01n2Organizational.5-01.n 01.04 Network Access Control
- 0811.01n2Organizational.6-01.n 01.04 Network Access Control
- 0812.01n2Organizational.8-01.n 01.04 Network Access Control
- 0814.01n1Organizational.12-01.n 01.04 Network Access Control
1 more clause
- 0943.09y1Organizational.1-09.y 09.09 Electronic Commerce Services
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(c)(1) Integrity
- 164.312(c)(2) Mechanism to authenticate electronic protected health information
- 164.312(e)(1) Transmission security
- 164.312(e)(2)(i) Integrity controls
1 more clause
- 164.312(e)(2)(ii) Encryption
- 6.5.3: Insecure cryptographic storage.
- Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using approaches like one-way hashes based on strong cryptography, truncation etc
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_secure_transfer_required_enabled - Powerpipe Control:
azure_compliance.control.storage_account_secure_transfer_required_enabled - Prowler Check:
storage_secure_transfer_required_is_enabled - Azure Policy Definitions:
404c3081-a854-4457-ae30-26a93ef643f9,f81e3117-0093-4b17-8a60-82363134f0eb - KICS Query:
12944ec4-1fa0-47be-8b17-42a034f937c2 - Trivy Checks:
AZU-0008,AZU-0059
Last reviewed: 2026-10-15