Storage Container Is Publicly Accessible

• Query id: dd5230f8-a577-4bbb-b7ac-f2c2fe7d5299
• Query name: Storage Container Is Publicly Accessible
• Platform: Terraform
• Severity: High
• Category: Access Control
• CWE: 285
• URL: Github

Description

Anonymous, public read access to a container and its blobs are enabled in Azure Blob Storage
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - tf file

resource "azurerm_storage_container" "positive1" {
  name                  = "vhds"
  storage_account_name  = azurerm_storage_account.example.name
  container_access_type = "blob"
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file

resource "azurerm_storage_container" "negative1" {
  name                  = "vhds"
  storage_account_name  = azurerm_storage_account.example.name
  container_access_type = "private"
}

resource "azurerm_storage_container" "negative2" {
  name                  = "vhds2"
  storage_account_name  = azurerm_storage_account.example.name
  // default is "private"
}