Mandate minimum TLS version of 1.2 for all storage accounts

[craddm]

✅ Checklist

• You have given your pull request a meaningful title (e.g. Enable foobar integration rather than 515 foobar).
• You are targeting the appropriate branch. If you're not certain which one this is, it should be develop.
• Your branch is up-to-date with the target branch (it probably was when you started, but it may have changed since then).

🚦 Depends on

⤴️ Summary

As per pentest report, storage accounts in SREs currently allow a minimum TLS version of 1.0, which is deprecated.

Note that this also applies to the SHM storage account, and this PR also modifies the minimum version there.

🌂 Related issues

🔬 Tests

Deployed SRE using these changes.

• mounting the accounts inside the SRE
• reading/writing from inside the SRE
• accessing them from Azure Store Explorer

[jemrobinson]

Is this a from-scratch SRE? I'd like to know whether this causes any problems for any of:

• mounting the accounts inside the SRE
• reading/writing (as appropriate) from inside the SRE
• accessing them from Azure Storage Explorer

Could you give details on this issue when you have them?

[craddm]

Is this a from-scratch SRE? I'd like to know whether this causes any problems for any of:

• mounting the accounts inside the SRE
• reading/writing (as appropriate) from inside the SRE
• accessing them from Azure Storage Explorer

Could you give details on this issue when you have them?

It isn't a from scratch SRE - I deleted and redeployed the storage accounts. However, currently having issues restarting the gitea container group. Going to try a fresh deployment instead.

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.

[craddm]

Is this a from-scratch SRE? I'd like to know whether this causes any problems for any of:

• mounting the accounts inside the SRE
• reading/writing (as appropriate) from inside the SRE
• accessing them from Azure Storage Explorer

Could you give details on this issue when you have them?

All worked fine as far as I can tell. Successfully uploaded and downloaded from ingress and egress via storage explore. Successfully copied from input and to output from the SRE desktop

[jemrobinson]

Cool - that's /ingress and /egress. Can you check /home (presumably working if you logged in) and /shared as well?

[JimMadge]

LGTM. We should be careful to test this thoroughly though as we are merging to the release branch.

[jemrobinson]

@JimMadge : I'm comfortable that Matt has tested /data and /output (also /home and maybe /shared). Do you think we need/want an independent test of these?

[craddm]

@JimMadge : I'm comfortable that Matt has tested /data and /output (also /home and maybe /shared). Do you think we need/want an independent test of these?

Yes, home and shared working fine too

Just now deployed an SHM with the updated TLS too

[jemrobinson]

Happy to merge this @JimMadge ?