Storage Blob Service Container With Public Access

• Query id: a0ab985d-660b-41f7-ac81-70957ee8e627
• Query name: Storage Blob Service Container With Public Access
• Platform: AzureResourceManager
• Severity: High
• Category: Networking and Firewall
• CWE: 284
• URL: Github

Description

The Storage Blob Service Container should not be publicly accessible
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - bicep file

resource blob_container_example 'Microsoft.Storage/storageAccounts/blobServices/containers@2021-02-01' = {
  name: 'blob/container/example'
  properties: {
    denyEncryptionScopeOverride: true
    publicAccess: 'Container'
    metadata: {}
  }
}

Positive test num. 2 - json file

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "2.0.0.0",
  "apiProfile": "2019-03-01-hybrid",
  "parameters": {},
  "variables": {},
  "functions": [],
  "resources": [
    {
      "name": "blob/container/example",
      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
      "apiVersion": "2021-02-01",
      "properties": {
        "denyEncryptionScopeOverride": true,
        "publicAccess": "Container",
        "metadata": {}
      },
      "resources": []
    }
  ],
  "outputs": {}
}

Positive test num. 3 - bicep file

@description('Name of the virtual network to use for cloud shell containers.')
param existingVNETName string

@description('Name of the subnet to use for storage account.')
param existingStorageSubnetName string

@description('Name of the subnet to use for cloud shell containers.')
param existingContainerSubnetName string

@description('Name of the storage account in subnet.')
param storageAccountName string

@description('Location for all resources.')
param location string = resourceGroup().location

var containerSubnetRef = resourceId(
  'Microsoft.Network/virtualNetworks/subnets',
  existingVNETName,
  existingContainerSubnetName
)
var storageSubnetRef = resourceId(
  'Microsoft.Network/virtualNetworks/subnets',
  existingVNETName,
  existingStorageSubnetName
)

resource storageAccount 'Microsoft.Storage/storageAccounts@2019-06-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: 'Standard_LRS'
    tier: 'Standard'
  }
  kind: 'StorageV2'
  properties: {
    networkAcls: {
      bypass: 'None'
      virtualNetworkRules: [
        {
          id: containerSubnetRef
          action: 'Allow'
        }
        {
          id: storageSubnetRef
          action: 'Allow'
        }
      ]
      defaultAction: 'Deny'
    }
    supportsHttpsTrafficOnly: true
    encryption: {
      services: {
        file: {
          keyType: 'Account'
          enabled: true
        }
        blob: {
          keyType: 'Account'
          enabled: true
        }
      }
      keySource: 'Microsoft.Storage'
    }
    accessTier: 'Cool'
  }
}

resource storageAccountName_default 'Microsoft.Storage/storageAccounts/blobServices@2019-06-01' = {
  parent: storageAccount
  name: 'default'
  sku: {
    name: 'Standard_LRS'
    tier: 'Standard'
  }
  properties: {
    deleteRetentionPolicy: {
      enabled: false
    }
  }
}

resource storageAccountName_default_container 'Microsoft.Storage/storageAccounts/blobServices/containers@2019-06-01' = {
  parent: storageAccountName_default
  name: 'container'
  properties: {
    denyEncryptionScopeOverride: true
    publicAccess: 'Blob'
    metadata: {}
  }
}

Positive test num. 4 - json file

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "existingVNETName": {
      "type": "string",
      "metadata": {
        "description": "Name of the virtual network to use for cloud shell containers."
      }
    },
    "existingStorageSubnetName": {
      "type": "string",
      "metadata": {
        "description": "Name of the subnet to use for storage account."
      }
    },
    "existingContainerSubnetName": {
      "type": "string",
      "metadata": {
        "description": "Name of the subnet to use for cloud shell containers."
      }
    },
    "storageAccountName": {
      "type": "string",
      "metadata": {
        "description": "Name of the storage account in subnet."
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {
    "containerSubnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('existingVNETName'), parameters('existingContainerSubnetName'))]",
    "storageSubnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('existingVNETName'), parameters('existingStorageSubnetName'))]"
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2019-06-01",
      "name": "[parameters('storageAccountName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard_LRS",
        "tier": "Standard"
      },
      "kind": "StorageV2",
      "properties": {
        "networkAcls": {
          "bypass": "None",
          "virtualNetworkRules": [
            {
              "id": "[variables('containerSubnetRef')]",
              "action": "Allow"
            },
            {
              "id": "[variables('storageSubnetRef')]",
              "action": "Allow"
            }
          ],
          "defaultAction": "Deny"
        },
        "supportsHttpsTrafficOnly": true,
        "encryption": {
          "services": {
            "file": {
              "keyType": "Account",
              "enabled": true
            },
            "blob": {
              "keyType": "Account",
              "enabled": true
            }
          },
          "keySource": "Microsoft.Storage"
        },
        "accessTier": "Cool"
      }
    },
    {
      "type": "Microsoft.Storage/storageAccounts/blobServices",
      "apiVersion": "2019-06-01",
      "name": "[concat(parameters('storageAccountName'), '/default')]",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
      ],
      "sku": {
        "name": "Standard_LRS",
        "tier": "Standard"
      },
      "properties": {
        "deleteRetentionPolicy": {
          "enabled": false
        }
      },
      "resources": [
        {
          "type": "containers",
          "apiVersion": "2019-06-01",
          "name": "container",
          "properties": {
            "denyEncryptionScopeOverride": true,
            "publicAccess": "Blob",
            "metadata": {}
          }
        }
      ]
    }
  ]
}

Positive test num. 5 - bicep file

@description('Specifies the name of the Azure Storage account.')
param storageAccountName string

@description('Specifies the name of the blob container.')
param containerName string = 'logs'

@description(
  'Specifies the location in which the Azure Storage resources should be deployed.'
)
param location string = resourceGroup().location

resource storageAccount 'Microsoft.Storage/storageAccounts@2019-06-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: 'Standard_LRS'
    tier: 'Standard'
  }
  kind: 'StorageV2'
  properties: {
    accessTier: 'Hot'
  }
}

resource storageAccountName_default_container 'Microsoft.Storage/storageAccounts/blobServices/containers@2019-06-01' = {
  name: '${storageAccountName}/default/${containerName}'
  properties: {
    denyEncryptionScopeOverride: true
    publicAccess: 'Blob'
    metadata: {}
  }
  dependsOn: [storageAccount]
}

Positive test num. 6 - json file

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageAccountName": {
      "type": "string",
      "metadata": {
        "description": "Specifies the name of the Azure Storage account."
      }
    },
    "containerName": {
      "type": "string",
      "defaultValue": "logs",
      "metadata": {
        "description": "Specifies the name of the blob container."
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Specifies the location in which the Azure Storage resources should be deployed."
      }
    }
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2019-06-01",
      "name": "[parameters('storageAccountName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard_LRS",
        "tier": "Standard"
      },
      "kind": "StorageV2",
      "properties": {
        "accessTier": "Hot"
      },
      "resources": [
        {
          "type": "blobServices/containers",
          "apiVersion": "2019-06-01",
          "name": "[concat('default/', parameters('containerName'))]",
          "dependsOn": [
            "[parameters('storageAccountName')]"
          ],
          "properties": {
            "denyEncryptionScopeOverride": true,
            "publicAccess": "Blob",
            "metadata": {}
          }
        }
      ]
    }
  ]
}

Positive test num. 7 - json file

{
  "properties": {
    "template": {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "2.0.0.0",
      "apiProfile": "2019-03-01-hybrid",
      "parameters": {},
      "variables": {},
      "functions": [],
      "resources": [
        {
          "name": "blob/container/example",
          "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
          "apiVersion": "2021-02-01",
          "properties": {
            "denyEncryptionScopeOverride": true,
            "publicAccess": "Container",
            "metadata": {}
          },
          "resources": []
        }
      ],
      "outputs": {}
    },
    "resourceGroup": "storageRG",
    "parameters": {
      "storageAccountType": {
        "value": "[parameters('storageAccountType')]"
      }
    }
  },
  "kind": "template",
  "id": "/providers/Microsoft.Management/managementGroups/ContosoOnlineGroup/providers/Microsoft.Blueprint/blueprints/simpleBlueprint/artifacts/storageTemplate",
  "type": "Microsoft.Blueprint/blueprints/artifacts",
  "name": "storageTemplate"
}

Positive test num. 8 - json file

{
  "properties": {
    "template": {
      "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
        "existingVNETName": {
          "type": "string",
          "metadata": {
            "description": "Name of the virtual network to use for cloud shell containers."
          }
        },
        "existingStorageSubnetName": {
          "type": "string",
          "metadata": {
            "description": "Name of the subnet to use for storage account."
          }
        },
        "existingContainerSubnetName": {
          "type": "string",
          "metadata": {
            "description": "Name of the subnet to use for cloud shell containers."
          }
        },
        "storageAccountName": {
          "type": "string",
          "metadata": {
            "description": "Name of the storage account in subnet."
          }
        },
        "location": {
          "type": "string",
          "defaultValue": "[resourceGroup().location]",
          "metadata": {
            "description": "Location for all resources."
          }
        }
      },
      "variables": {
        "containerSubnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('existingVNETName'), parameters('existingContainerSubnetName'))]",
        "storageSubnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('existingVNETName'), parameters('existingStorageSubnetName'))]"
      },
      "resources": [
        {
          "type": "Microsoft.Storage/storageAccounts",
          "apiVersion": "2019-06-01",
          "name": "[parameters('storageAccountName')]",
          "location": "[parameters('location')]",
          "sku": {
            "name": "Standard_LRS",
            "tier": "Standard"
          },
          "kind": "StorageV2",
          "properties": {
            "networkAcls": {
              "bypass": "None",
              "virtualNetworkRules": [
                {
                  "id": "[variables('containerSubnetRef')]",
                  "action": "Allow"
                },
                {
                  "id": "[variables('storageSubnetRef')]",
                  "action": "Allow"
                }
              ],
              "defaultAction": "Deny"
            },
            "supportsHttpsTrafficOnly": true,
            "encryption": {
              "services": {
                "file": {
                  "keyType": "Account",
                  "enabled": true
                },
                "blob": {
                  "keyType": "Account",
                  "enabled": true
                }
              },
              "keySource": "Microsoft.Storage"
            },
            "accessTier": "Cool"
          }
        },
        {
          "type": "Microsoft.Storage/storageAccounts/blobServices",
          "apiVersion": "2019-06-01",
          "name": "[concat(parameters('storageAccountName'), '/default')]",
          "dependsOn": [
            "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
          ],
          "sku": {
            "name": "Standard_LRS",
            "tier": "Standard"
          },
          "properties": {
            "deleteRetentionPolicy": {
              "enabled": false
            }
          },
          "resources": [
            {
              "type": "containers",
              "apiVersion": "2019-06-01",
              "name": "container",
              "properties": {
                "denyEncryptionScopeOverride": true,
                "publicAccess": "Blob",
                "metadata": {}
              }
            }
          ]
        }
      ]
    },
    "resourceGroup": "storageRG",
    "parameters": {
      "storageAccountType": {
        "value": "[parameters('storageAccountType')]"
      }
    }
  },
  "kind": "template",
  "id": "/providers/Microsoft.Management/managementGroups/ContosoOnlineGroup/providers/Microsoft.Blueprint/blueprints/simpleBlueprint/artifacts/storageTemplate",
  "type": "Microsoft.Blueprint/blueprints/artifacts",
  "name": "storageTemplate"
}

Positive test num. 9 - json file

{
  "properties": {
    "template": {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
        "storageAccountName": {
          "type": "string",
          "metadata": {
            "description": "Specifies the name of the Azure Storage account."
          }
        },
        "containerName": {
          "type": "string",
          "defaultValue": "logs",
          "metadata": {
            "description": "Specifies the name of the blob container."
          }
        },
        "location": {
          "type": "string",
          "defaultValue": "[resourceGroup().location]",
          "metadata": {
            "description": "Specifies the location in which the Azure Storage resources should be deployed."
          }
        }
      },
      "resources": [
        {
          "type": "Microsoft.Storage/storageAccounts",
          "apiVersion": "2019-06-01",
          "name": "[parameters('storageAccountName')]",
          "location": "[parameters('location')]",
          "sku": {
            "name": "Standard_LRS",
            "tier": "Standard"
          },
          "kind": "StorageV2",
          "properties": {
            "accessTier": "Hot"
          },
          "resources": [
            {
              "type": "blobServices/containers",
              "apiVersion": "2019-06-01",
              "name": "[concat('default/', parameters('containerName'))]",
              "dependsOn": [
                "[parameters('storageAccountName')]"
              ],
              "properties": {
                "denyEncryptionScopeOverride": true,
                "publicAccess": "Blob",
                "metadata": {}
              }
            }
          ]
        }
      ]
    },
    "resourceGroup": "storageRG",
    "parameters": {
      "storageAccountType": {
        "value": "[parameters('storageAccountType')]"
      }
    }
  },
  "kind": "template",
  "id": "/providers/Microsoft.Management/managementGroups/ContosoOnlineGroup/providers/Microsoft.Blueprint/blueprints/simpleBlueprint/artifacts/storageTemplate",
  "type": "Microsoft.Blueprint/blueprints/artifacts",
  "name": "storageTemplate"
}

Positive test num. 10 - json file

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "existingVNETName": {
      "type": "string",
      "metadata": {
        "description": "Name of the virtual network to use for cloud shell containers."
      }
    },
    "existingStorageSubnetName": {
      "type": "string",
      "metadata": {
        "description": "Name of the subnet to use for storage account."
      }
    },
    "existingContainerSubnetName": {
      "type": "string",
      "metadata": {
        "description": "Name of the subnet to use for cloud shell containers."
      }
    },
    "storageAccountName": {
      "type": "string",
      "metadata": {
        "description": "Name of the storage account in subnet."
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {
    "containerSubnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('existingVNETName'), parameters('existingContainerSubnetName'))]",
    "storageSubnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('existingVNETName'), parameters('existingStorageSubnetName'))]"
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2019-06-01",
      "name": "[parameters('storageAccountName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard_LRS",
        "tier": "Standard"
      },
      "kind": "StorageV2",
      "properties": {
        "networkAcls": {
          "defaultAction": "Deny"
        },
        "supportsHttpsTrafficOnly": true,
        "encryption": {
          "services": {
            "file": {
              "keyType": "Account",
              "enabled": true
            },
            "blob": {
              "keyType": "Account",
              "enabled": true
            }
          },
          "keySource": "Microsoft.Storage"
        },
        "accessTier": "Cool"
      },
      "resources": [
        {
          "type": "blobServices",
          "apiVersion": "2019-06-01",
          "name": "[concat(parameters('storageAccountName'), '/default')]",
          "dependsOn": [
            "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
          ],
          "sku": {
            "name": "Standard_LRS",
            "tier": "Standard"
          },
          "properties": {
            "deleteRetentionPolicy": {
              "enabled": false
            }
          },
          "resources": [
            {
              "type": "containers",
              "apiVersion": "2019-06-01",
              "name": "container",
              "properties": {
                "denyEncryptionScopeOverride": true,
                "publicAccess": "Blob",
                "metadata": {}
              }
            }
          ]
        }
      ]
    }
  ]
}

Code samples without security vulnerabilities

Negative test num. 1 - bicep file

resource blob_container_example 'Microsoft.Storage/storageAccounts/blobServices/containers@2021-02-01' = {
  name: 'blob/container/example'
  properties: {
    denyEncryptionScopeOverride: true
    publicAccess: 'None'
    metadata: {}
  }
}

Negative test num. 2 - json file

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "2.0.0.0",
  "apiProfile": "2019-03-01-hybrid",
  "parameters": {},
  "variables": {},
  "functions": [],
  "resources": [
    {
      "name": "blob/container/example",
      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
      "apiVersion": "2021-02-01",
      "properties": {
        "denyEncryptionScopeOverride": true,
        "publicAccess": "None",
        "metadata": {}
      },
      "resources": []
    }
  ],
  "outputs": {}
}

Negative test num. 3 - bicep file

@description('Name of the virtual network to use for cloud shell containers.')
param existingVNETName string

@description('Name of the subnet to use for storage account.')
param existingStorageSubnetName string

@description('Name of the subnet to use for cloud shell containers.')
param existingContainerSubnetName string

@description('Name of the storage account in subnet.')
param storageAccountName string

@description('Location for all resources.')
param location string = resourceGroup().location

var containerSubnetRef = resourceId(
  'Microsoft.Network/virtualNetworks/subnets',
  existingVNETName,
  existingContainerSubnetName
)
var storageSubnetRef = resourceId(
  'Microsoft.Network/virtualNetworks/subnets',
  existingVNETName,
  existingStorageSubnetName
)

resource storageAccount 'Microsoft.Storage/storageAccounts@2019-06-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: 'Standard_LRS'
    tier: 'Standard'
  }
  kind: 'StorageV2'
  properties: {
    networkAcls: {
      bypass: 'None'
      virtualNetworkRules: [
        {
          id: containerSubnetRef
          action: 'Allow'
        }
        {
          id: storageSubnetRef
          action: 'Allow'
        }
      ]
      defaultAction: 'Deny'
    }
    supportsHttpsTrafficOnly: true
    encryption: {
      services: {
        file: {
          keyType: 'Account'
          enabled: true
        }
        blob: {
          keyType: 'Account'
          enabled: true
        }
      }
      keySource: 'Microsoft.Storage'
    }
    accessTier: 'Cool'
  }
}

resource storageAccountName_default 'Microsoft.Storage/storageAccounts/blobServices@2019-06-01' = {
  parent: storageAccount
  name: 'default'
  sku: {
    name: 'Standard_LRS'
    tier: 'Standard'
  }
  properties: {
    deleteRetentionPolicy: {
      enabled: false
    }
  }
}

resource storageAccountName_default_container 'Microsoft.Storage/storageAccounts/blobServices/containers@2019-06-01' = {
  parent: storageAccountName_default
  name: 'container'
  properties: {
    denyEncryptionScopeOverride: true
    publicAccess: 'None'
    metadata: {}
  }
}

Negative test num. 4 - json file

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "existingVNETName": {
      "type": "string",
      "metadata": {
        "description": "Name of the virtual network to use for cloud shell containers."
      }
    },
    "existingStorageSubnetName": {
      "type": "string",
      "metadata": {
        "description": "Name of the subnet to use for storage account."
      }
    },
    "existingContainerSubnetName": {
      "type": "string",
      "metadata": {
        "description": "Name of the subnet to use for cloud shell containers."
      }
    },
    "storageAccountName": {
      "type": "string",
      "metadata": {
        "description": "Name of the storage account in subnet."
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {
    "containerSubnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('existingVNETName'), parameters('existingContainerSubnetName'))]",
    "storageSubnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('existingVNETName'), parameters('existingStorageSubnetName'))]"
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2019-06-01",
      "name": "[parameters('storageAccountName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard_LRS",
        "tier": "Standard"
      },
      "kind": "StorageV2",
      "properties": {
        "networkAcls": {
          "bypass": "None",
          "virtualNetworkRules": [
            {
              "id": "[variables('containerSubnetRef')]",
              "action": "Allow"
            },
            {
              "id": "[variables('storageSubnetRef')]",
              "action": "Allow"
            }
          ],
          "defaultAction": "Deny"
        },
        "supportsHttpsTrafficOnly": true,
        "encryption": {
          "services": {
            "file": {
              "keyType": "Account",
              "enabled": true
            },
            "blob": {
              "keyType": "Account",
              "enabled": true
            }
          },
          "keySource": "Microsoft.Storage"
        },
        "accessTier": "Cool"
      }
    },
    {
      "type": "Microsoft.Storage/storageAccounts/blobServices",
      "apiVersion": "2019-06-01",
      "name": "[concat(parameters('storageAccountName'), '/default')]",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
      ],
      "sku": {
        "name": "Standard_LRS",
        "tier": "Standard"
      },
      "properties": {
        "deleteRetentionPolicy": {
          "enabled": false
        }
      },
      "resources": [
        {
          "type": "containers",
          "apiVersion": "2019-06-01",
          "name": "container",
          "properties": {
            "denyEncryptionScopeOverride": true,
            "publicAccess": "None",
            "metadata": {}
          }
        }
      ]
    }
  ]
}

Negative test num. 5 - bicep file

@description('Specifies the name of the Azure Storage account.')
param storageAccountName string

@description('Specifies the name of the blob container.')
param containerName string = 'logs'

@description(
  'Specifies the location in which the Azure Storage resources should be deployed.'
)
param location string = resourceGroup().location

resource storageAccount 'Microsoft.Storage/storageAccounts@2019-06-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: 'Standard_LRS'
    tier: 'Standard'
  }
  kind: 'StorageV2'
  properties: {
    accessTier: 'Hot'
  }
}

resource storageAccountName_default_container 'Microsoft.Storage/storageAccounts/blobServices/containers@2019-06-01' = {
  name: '${storageAccountName}/default/${containerName}'
  properties: {
    denyEncryptionScopeOverride: true
    publicAccess: 'None'
    metadata: {}
  }
  dependsOn: [storageAccount]
}

Negative test num. 6 - json file

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageAccountName": {
      "type": "string",
      "metadata": {
        "description": "Specifies the name of the Azure Storage account."
      }
    },
    "containerName": {
      "type": "string",
      "defaultValue": "logs",
      "metadata": {
        "description": "Specifies the name of the blob container."
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Specifies the location in which the Azure Storage resources should be deployed."
      }
    }
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2019-06-01",
      "name": "[parameters('storageAccountName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard_LRS",
        "tier": "Standard"
      },
      "kind": "StorageV2",
      "properties": {
        "accessTier": "Hot"
      },
      "resources": [
        {
          "type": "blobServices/containers",
          "apiVersion": "2019-06-01",
          "name": "[concat('default/', parameters('containerName'))]",
          "dependsOn": [
            "[parameters('storageAccountName')]"
          ],
          "properties": {
            "denyEncryptionScopeOverride": true,
            "publicAccess": "None",
            "metadata": {}
          }
        }
      ]
    }
  ]
}

Negative test num. 7 - json file

{
  "properties": {
    "template": {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "2.0.0.0",
      "apiProfile": "2019-03-01-hybrid",
      "parameters": {},
      "variables": {},
      "functions": [],
      "resources": [
        {
          "name": "blob/container/example",
          "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
          "apiVersion": "2021-02-01",
          "properties": {
            "denyEncryptionScopeOverride": true,
            "publicAccess": "None",
            "metadata": {}
          },
          "resources": []
        }
      ],
      "outputs": {}
    },
    "resourceGroup": "storageRG",
    "parameters": {
      "storageAccountType": {
        "value": "[parameters('storageAccountType')]"
      }
    }
  },
  "kind": "template",
  "id": "/providers/Microsoft.Management/managementGroups/ContosoOnlineGroup/providers/Microsoft.Blueprint/blueprints/simpleBlueprint/artifacts/storageTemplate",
  "type": "Microsoft.Blueprint/blueprints/artifacts",
  "name": "storageTemplate"
}

Negative test num. 8 - json file

{
  "properties": {
    "template": {
      "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
        "existingVNETName": {
          "type": "string",
          "metadata": {
            "description": "Name of the virtual network to use for cloud shell containers."
          }
        },
        "existingStorageSubnetName": {
          "type": "string",
          "metadata": {
            "description": "Name of the subnet to use for storage account."
          }
        },
        "existingContainerSubnetName": {
          "type": "string",
          "metadata": {
            "description": "Name of the subnet to use for cloud shell containers."
          }
        },
        "storageAccountName": {
          "type": "string",
          "metadata": {
            "description": "Name of the storage account in subnet."
          }
        },
        "location": {
          "type": "string",
          "defaultValue": "[resourceGroup().location]",
          "metadata": {
            "description": "Location for all resources."
          }
        }
      },
      "variables": {
        "containerSubnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('existingVNETName'), parameters('existingContainerSubnetName'))]",
        "storageSubnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('existingVNETName'), parameters('existingStorageSubnetName'))]"
      },
      "resources": [
        {
          "type": "Microsoft.Storage/storageAccounts",
          "apiVersion": "2019-06-01",
          "name": "[parameters('storageAccountName')]",
          "location": "[parameters('location')]",
          "sku": {
            "name": "Standard_LRS",
            "tier": "Standard"
          },
          "kind": "StorageV2",
          "properties": {
            "networkAcls": {
              "bypass": "None",
              "virtualNetworkRules": [
                {
                  "id": "[variables('containerSubnetRef')]",
                  "action": "Allow"
                },
                {
                  "id": "[variables('storageSubnetRef')]",
                  "action": "Allow"
                }
              ],
              "defaultAction": "Deny"
            },
            "supportsHttpsTrafficOnly": true,
            "encryption": {
              "services": {
                "file": {
                  "keyType": "Account",
                  "enabled": true
                },
                "blob": {
                  "keyType": "Account",
                  "enabled": true
                }
              },
              "keySource": "Microsoft.Storage"
            },
            "accessTier": "Cool"
          }
        },
        {
          "type": "Microsoft.Storage/storageAccounts/blobServices",
          "apiVersion": "2019-06-01",
          "name": "[concat(parameters('storageAccountName'), '/default')]",
          "dependsOn": [
            "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
          ],
          "sku": {
            "name": "Standard_LRS",
            "tier": "Standard"
          },
          "properties": {
            "deleteRetentionPolicy": {
              "enabled": false
            }
          },
          "resources": [
            {
              "type": "containers",
              "apiVersion": "2019-06-01",
              "name": "container",
              "properties": {
                "denyEncryptionScopeOverride": true,
                "publicAccess": "None",
                "metadata": {}
              }
            }
          ]
        }
      ]
    },
    "resourceGroup": "storageRG",
    "parameters": {
      "storageAccountType": {
        "value": "[parameters('storageAccountType')]"
      }
    }
  },
  "kind": "template",
  "id": "/providers/Microsoft.Management/managementGroups/ContosoOnlineGroup/providers/Microsoft.Blueprint/blueprints/simpleBlueprint/artifacts/storageTemplate",
  "type": "Microsoft.Blueprint/blueprints/artifacts",
  "name": "storageTemplate"
}

Negative test num. 9 - json file

{
  "properties": {
    "template": {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
        "storageAccountName": {
          "type": "string",
          "metadata": {
            "description": "Specifies the name of the Azure Storage account."
          }
        },
        "containerName": {
          "type": "string",
          "defaultValue": "logs",
          "metadata": {
            "description": "Specifies the name of the blob container."
          }
        },
        "location": {
          "type": "string",
          "defaultValue": "[resourceGroup().location]",
          "metadata": {
            "description": "Specifies the location in which the Azure Storage resources should be deployed."
          }
        }
      },
      "resources": [
        {
          "type": "Microsoft.Storage/storageAccounts",
          "apiVersion": "2019-06-01",
          "name": "[parameters('storageAccountName')]",
          "location": "[parameters('location')]",
          "sku": {
            "name": "Standard_LRS",
            "tier": "Standard"
          },
          "kind": "StorageV2",
          "properties": {
            "accessTier": "Hot"
          },
          "resources": [
            {
              "type": "blobServices/containers",
              "apiVersion": "2019-06-01",
              "name": "[concat('default/', parameters('containerName'))]",
              "dependsOn": [
                "[parameters('storageAccountName')]"
              ],
              "properties": {
                "denyEncryptionScopeOverride": true,
                "publicAccess": "None",
                "metadata": {}
              }
            }
          ]
        }
      ]
    },
    "resourceGroup": "storageRG",
    "parameters": {
      "storageAccountType": {
        "value": "[parameters('storageAccountType')]"
      }
    }
  },
  "kind": "template",
  "id": "/providers/Microsoft.Management/managementGroups/ContosoOnlineGroup/providers/Microsoft.Blueprint/blueprints/simpleBlueprint/artifacts/storageTemplate",
  "type": "Microsoft.Blueprint/blueprints/artifacts",
  "name": "storageTemplate"
}