Default Azure Storage Account Network Access Is Too Permissive
- Query id: d855ced8-6157-448f-9f1d-f05a41d046f7
- Query name: Default Azure Storage Account Network Access Is Too Permissive
- Platform: AzureResourceManager
- Severity: Medium
- Category: Access Control
- URL: Github
Description¶
Make sure that your Azure Storage Account access is limited to those who require it.
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - json file
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"apiVersion": "[variables('storageApiVersion')]",
"dependsOn": [],
"kind": "Storage",
"location": "[variables('computeLocation')]",
"name": "positive1",
"properties": {
"networkAcls": {
"defaultAction": "Allow"
}
},
"sku": {
"name": "[parameters('supportLogStorageAccountType')]"
},
"tags": {},
"type": "Microsoft.Storage/storageAccounts"
}
]
}
Postitive test num. 2 - json file
{
"document": [
{
"resources": [
{
"apiVersion": "[variables('storageApiVersion')]",
"dependsOn": [],
"kind": "Storage",
"location": "[variables('computeLocation')]",
"name": "positive2",
"properties": {},
"sku": {
"name": "[parameters('supportLogStorageAccountType')]"
},
"tags": {},
"type": "Microsoft.Storage/storageAccounts"
}
]
}
]
}
Postitive test num. 3 - json file
{
"document": [
{
"resources": [
{
"apiVersion": "[variables('storageApiVersion')]",
"dependsOn": [],
"kind": "Storage",
"location": "[variables('computeLocation')]",
"name": "positive3",
"properties": {
"publicNetworkAccess": "Enabled"
},
"sku": {
"name": "[parameters('supportLogStorageAccountType')]"
},
"tags": {},
"type": "Microsoft.Storage/storageAccounts"
}
]
}
]
}
Code samples without security vulnerabilities¶
Negative test num. 1 - json file
{
"document": [
{
"resources": [
{
"apiVersion": "[variables('storageApiVersion')]",
"dependsOn": [],
"kind": "Storage",
"location": "[variables('computeLocation')]",
"name": "negative1",
"properties": {
"publicNetworkAccess": "Disabled"
},
"sku": {
"name": "[parameters('supportLogStorageAccountType')]"
},
"tags": {},
"type": "Microsoft.Storage/storageAccounts"
}
]
}
]
}
Negative test num. 2 - json file
{
"document": [
{
"resources": [
{
"apiVersion": "[variables('storageApiVersion')]",
"dependsOn": [],
"kind": "Storage",
"location": "[variables('computeLocation')]",
"name": "negative2",
"properties": {
"networkAcls": {
"defaultAction": "Deny"
}
},
"sku": {
"name": "[parameters('supportLogStorageAccountType')]"
},
"tags": {},
"type": "Microsoft.Storage/storageAccounts"
}
]
}
]
}