bug(misconf): AZU-0056 false positive when blob soft delete is configured as a nested ARM blobServices resource

[ankur-kapoor-uk]

Description

Summary

Trivy reports AZU-0056 ("Storage account should have blob soft delete enabled")
for an ARM template that enables seven-day blob soft delete through a nested
Microsoft.Storage/storageAccounts/blobServices resource.

Azure's management API confirms that soft delete is enabled on the deployed
blob service. This appears to be an ARM adapter recognition issue rather than
a missing control.

Desired Behavior

Trivy should recognize the nested blobServices/default resource and not
report AZU-0056 when blob soft delete is enabled with positive retention.

Disabling or removing the policy should still produce the finding.

Actual Behavior

On the original equivalent template, Trivy reports:

AZU-0056 (MEDIUM): Storage account should have blob soft delete enabled
Storage account does not have blob soft delete enabled.

The deployed blob service returns:

{
  "deleteRetentionPolicy": {
    "enabled": true,
    "days": 7,
    "allowPermanentDelete": false
  }
}

Reproduction Steps

Minimal ARM example

Save as repro/storage.json:

{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Storage/storageAccounts",
"apiVersion": "2019-06-01",
"name": "softdeleterepro123",
"location": "uksouth",
"kind": "StorageV2",
"sku": {
"name": "Standard_LRS"
},
"properties": {
"supportsHttpsTrafficOnly": true,
"minimumTlsVersion": "TLS1_2",
"allowBlobPublicAccess": false
},
"resources": [
{
"type": "blobServices",
"apiVersion": "2019-06-01",
"name": "default",
"dependsOn": [
"[resourceId('Microsoft.Storage/storageAccounts', 'softdeleterepro123')]"
],
"properties": {
"deleteRetentionPolicy": {
"enabled": true,
"days": 7
}
}
}
]
}
]
}

Steps to reproduce

Inspect the results for AZU-0056 / AVD-AZU-0056.
Other findings from this deliberately minimal template are outside this report.

### Debug Output

```bash
"Misconfigurations": [
        {
          "Type": "Azure ARM Security Check",
          "ID": "AZU-0056",
          "Title": "Storage account should have blob soft delete enabled",
          "Description": "Blob soft delete protects blob data from being accidentally or erroneously modified or deleted.\nWhen blob soft delete is enabled, deleted blobs are retained in the system for a specified retention period.\nDuring the retention period, you can restore a soft-deleted blob to its state at the time it was deleted.\n",
          "Message": "Storage account does not have blob soft delete enabled.",
          "Namespace": "builtin.azure.storage.azure0056",
          "Query": "data.builtin.azure.storage.azure0056.deny",
          "Resolution": "Enable soft delete for blobs with an appropriate retention period",
          "Severity": "MEDIUM",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/azu-0056",
          "References": [
            "https://docs.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-overview",
            "https://avd.aquasec.com/misconfig/azu-0056"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Azure",
            "Service": "storage",
            "StartLine": 743,
            "EndLine": 752,
            "Code": {
              "Lines": [
                {
                  "Number": 1,
                  "Content": "{",
                  "IsCause": false,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "{",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 2,
                  "Content": "",
                  "IsCause": false,
                  "Annotation": "",
                  "Truncated": true,
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 743,
                  "Content": "            \"properties\": {",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "            \u001b[38;5;33m\"properties\"\u001b[0m: {",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 744,
                  "Content": "                \"allowBlobPublicAccess\": false,",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "                \u001b[38;5;33m\"allowBlobPublicAccess\"\u001b[0m: \u001b[38;5;166mfalse\u001b[0m,",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 745,
                  "Content": "                \"supportsHttpsTrafficOnly\": true,",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "                \u001b[38;5;33m\"supportsHttpsTrafficOnly\"\u001b[0m: \u001b[38;5;166mtrue\u001b[0m,",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 746,
                  "Content": "                \"minimumTlsVersion\": \"[variables('minimumTlsVersionForStorage')]\",",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "                \u001b[38;5;33m\"minimumTlsVersion\"\u001b[0m: \u001b[38;5;37m\"[variables('minimumTlsVersionForStorage')]\"\u001b[0m,",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 747,
                  "Content": "                \"publicNetworkAccess\": \"Enabled\",",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "                \u001b[38;5;33m\"publicNetworkAccess\"\u001b[0m: \u001b[38;5;37m\"Enabled\"\u001b[0m,",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 748,
                  "Content": "                \"networkAcls\": {",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "                \u001b[38;5;33m\"networkAcls\"\u001b[0m: {",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 749,
                  "Content": "                    \"bypass\": \"None\",",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "                    \u001b[38;5;33m\"bypass\"\u001b[0m: \u001b[38;5;37m\"None\"\u001b[0m,",
                  "FirstCause": false,
                  "LastCause": true
                },
                {
                  "Number": 750,
                  "Content": "",
                  "IsCause": false,
                  "Annotation": "",
                  "Truncated": true,
                  "FirstCause": false,
                  "LastCause": false
                }
              ]
            },
            "Occurrences": [
              {
                "Resource": "resources[20]",
                "Filename": "ehub_premium.json",
                "Location": {
                  "StartLine": 733,
                  "EndLine": 791
                }
              },
              {
                "Filename": "ehub_premium.json",
                "Location": {
                  "StartLine": 1,
                  "EndLine": 882
                }
              },
              {
                "Filename": "ehub_premium.json",
                "Location": {}
              }
            ]
          }
        }

Operating System

Linux — running Trivy in a container on an Azure DevOps agent

Version

Version: 0.75.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2026-11-05 07:00:54.926777429 +0000 UTC
  NextUpdate: 2026-11-06 07:00:54.926777259 +0000 UTC
  DownloadedAt: 2026-11-05 13:12:05.9097708 +0000 UTC
Check Bundle:
  Digest: sha256:b591e9190cff4aa4e385b1a25bccfd9ecf178d3c77fd194e1410b7ce7e1df058
  DownloadedAt: 2026-11-05 13:09:25.5498571 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Hi @ankur-kapoor-uk , thanks for the report!

Track #11566