Red Orbita
Home Linux & Systems Cybersecurity Cloud & DevOps Networks & Infrastructure SIEM & Monitoring DFIR & Threat Intel Development & Other All categories Projects About Tools

How to force TLS 1.2 on Azure Storage Account in bulk

Leer en espanol
August 1, 2025 Development & Other Cloud & DevOps rokitoh
How to force TLS 1.2 on Azure Storage Account in bulk

Table of contents

Over time, many default configurations in cloud environments become obsolete. One of the most critical cases, from a security point of view, is the use of vers ===

Introduction

Over time, many default configurations in cloud environments become obsolete. One of the most critical cases, from a security point of view, is the use of old versions of the TLS (Transport Layer Security) protocol.

Although TLS 1.0 and 1.1 are now deprecated and have known risks, it is surprisingly common to find Storage Account in Azure that they still have them enabled. This article shows you how update in a massive and automated way all your storage accounts to use only TLS 1.2, thus complying with current security standards and regulatory requirements such as PCI-DSS, ISO 27001 or NIST.

Why is it important?

  • TLS 1.0/1.1 are officially deprecated by IETF since March 2021.
  • Multiple vulnerabilities (such as POODLE or BEAST) affect older versions.
  • Security audits They detect it and penalize it.

 How to check the current TLS version?

You can check the TLS configuration for a storage account by running:

CODE
az storage account show --name <storage-account-name> --resource-group <rg-name> --query "minimumTlsVersion"

Script to upgrade all accounts to TLS 1.2

The following Bash script allows bulk update all your Azure storage accounts, using a list of resourceIds by environment (dev, pre, pro, etc.).

Expected directory structure

CODE
.
├── dev.txt
├── int.txt
├── poc.txt
├── pre.txt
├── pro.txt
├── test.txt
└── tls-update.sh

Each file .txt contains lines with resource IDs of storage accounts, for example:

CODE
/subscriptions/xxxx/resourceGroups/rg-dev/providers/Microsoft.Storage/storageAccounts/storage1
/subscriptions/yyyy/resourceGroups/rg-dev/providers/Microsoft.Storage/storageAccounts/storage2

Script tls-update.sh

BASH
#!/bin/bash

update_tls() {
    local resource_id=$1
    local subscription_id
    local rg
    local storage_account

    # Extrae valores con grep
    subscription_id=$(echo "$resource_id" | grep -oP '(?<=/subscriptions/)[^/]+')
    rg=$(echo "$resource_id" | grep -oP '(?<=resourceGroups/)[^/]+')
    storage_account=$(echo "$resource_id" | grep -oP '(?<=storageAccounts/)[^/]+')

    echo "[INFO] Estableciendo suscripción: $subscription_id"
    az account set --subscription "$subscription_id"

    echo "[INFO] Actualizando Storage Account: $storage_account en RG: $rg"
    az storage account update --name "$storage_account" --resource-group "$rg" --min-tls-version TLS1_2
}

process_file() {
    local file=$1
    echo "[INFO] Procesando fichero $file ..."

    while IFS= read -r line || [[ -n "$line" ]]; do
        update_tls "$line"
    done < "$file"
}

# Procesamiento de todos los entornos
for file in poc.txt dev.txt int.txt pre.txt pro.txt test.txt ; do
    if [[ -f "$file" ]]; then
        process_file "$file"
    else
        echo "[WARN] Fichero $file no encontrado, se salta."
    fi
done

:wq!

Comments