diff --git a/Scripts/RemediationScripts/Remediate-EnableEncryptionInTransitForStorageAccounts.ps1 b/Scripts/RemediationScripts/Remediate-EnableEncryptionInTransitForStorageAccounts.ps1 index 26184ce6..f6041361 100644 --- a/Scripts/RemediationScripts/Remediate-EnableEncryptionInTransitForStorageAccounts.ps1 +++ b/Scripts/RemediationScripts/Remediate-EnableEncryptionInTransitForStorageAccounts.ps1 @@ -349,6 +349,23 @@ function Enable-StorageEncryptionInTransit $storageAccounts | ForEach-Object { if ($_.EnableHttpsTrafficOnly) { + if($_.Kind -eq "FileStorage"){ + $fileshares=@() + $fileshares= Get-AzRMStorageShare -StorageAccountName $_.StorageAccountName -ResourceGroupName $_.ResourceGroupName + if(($fileshares|Measure-Object).Count -gt 0) + { + $SMBFileShares = @() + $NFSFileShares = @() + $SMBFileShares = $fileshares|Where-Object{$_.EnabledProtocols -contains "SMB"} + $NFSFileShares = $fileshares|Where-Object{$_.EnabledProtocols -contains "NFS"} + if($NFSFileShares.Count -gt 0 -and $SMBFileShares.Count -eq 0) + { + $storagewithOnlyNFSShares = $_.StorageAccountName + Write-Host "Excluding Storage Accounts $($_.StorageAccountName) with type FileStorage and having only NFS fileshares" + $storageAccounts=$storageAccounts|Where-Object{$_.StorageAccountName -ne $storagewithOnlyNFSShares} + } + } + } $stgWithEnableHTTPS += $_ } else @@ -609,6 +626,26 @@ function Disable-StorageEncryptionInTransit $remediatedResourceLog | ForEach-Object { try { + $res = Get-AzStorageAccount -ResourceGroupName $_.ResourceGroupName -Name _.StorageAccountName + if($_.Kind -eq "FileStorage"){ + $fileshares=@() + $fileshares= Get-AzRMStorageShare -StorageAccountName $_.StorageAccountName -ResourceGroupName $_.ResourceGroupName + if(($fileshares|Measure-Object).Count -gt 0) + { + $SMBFileShares = @() + $NFSFileShares = @() + $SMBFileShares = $fileshares|Where-Object{$_.EnabledProtocols -contains "SMB"} + $NFSFileShares = $fileshares|Where-Object{$_.EnabledProtocols -contains "NFS"} + if($NFSFileShares.Count -gt 0 -and $SMBFileShares.Count -eq 0) + { + $storagewithOnlyNFSShares = $_.StorageAccountName + Write-Host "Excluding Storage Accounts $($_.StorageAccountName) with type FileStorage and having only NFS fileshares" + continue + } + } + } + + $output = Set-AzStorageAccount -ResourceGroupName $_.ResourceGroupName -Name $_.StorageAccountName -EnableHttpsTrafficOnly $false -ErrorAction SilentlyContinue if($output -ne $null) { diff --git a/TemplateFiles/RemediationScripts.zip b/TemplateFiles/RemediationScripts.zip index d23df741..6a380efd 100644 Binary files a/TemplateFiles/RemediationScripts.zip and b/TemplateFiles/RemediationScripts.zip differ