Skip to main content

Storage Account container containing the logs is not publicly accessible

More Info:​

Allowing public access to activity log content may aid an adversary in identifying weaknesses in the affected accounts use or configuration.

Risk Level​

Low

Address​

Operational Maturity, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AZURE
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HITRUST CSF
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration in Azure, you can follow these steps:

  1. Open the Azure portal and navigate to the storage account that contains the container with the logs.

  2. Click on the "Containers" tab on the left-hand side of the screen.

  3. Select the container that contains the logs.

  4. Click on the "Access policy" tab on the top of the screen.

  5. Under the "Public access level" section, select "Private (no anonymous access)".

  6. Click on the "Save" button at the top of the screen to save the changes.

  7. Verify that the container is no longer publicly accessible by trying to access it from a different browser or device.

By following these steps, you have successfully remediated the misconfiguration and ensured that the storage account container containing the logs is no longer publicly accessible.

Using CLI

To remediate the issue of a publicly accessible Storage Account container containing logs in Azure, you can follow the steps below using Azure CLI:

  1. Log in to your Azure account using the Azure CLI command az login.

  2. Once you have successfully logged in, you can list all the storage accounts in your subscription using the command az storage account list.

  3. Identify the storage account that contains the publicly accessible container and copy its resource group and name.

  4. Use the following command to update the access level of the container to private:

    az storage container set-permission --account-name <storage_account_name> --account-key <storage_account_key> --name <container_name> --public-access off

    Replace <storage_account_name> with the name of the storage account, <storage_account_key> with the account key of the storage account, and <container_name> with the name of the container that contains the logs.

  5. Verify that the access level of the container has been updated to private by running the command az storage container show --account-name <storage_account_name> --account-key <storage_account_key> --name <container_name>.

    If the access level is set to private, you have successfully remediated the issue.

By following these steps, you can remediate the issue of a publicly accessible Storage Account container containing logs in Azure using Azure CLI.

Using Python

To remediate the misconfiguration in Azure using Python, you can follow these steps:

  1. Import the required modules:
from azure.storage.blob import BlobServiceClient, PublicAccess
from azure.core.exceptions import ResourceExistsError
  1. Connect to the Azure Storage Account using the connection string:
connection_string = "<your_connection_string>"
blob_service_client = BlobServiceClient.from_connection_string(connection_string)
  1. Get the container name that contains the logs:
container_name = "<your_container_name>"
container_client = blob_service_client.get_container_client(container_name)
  1. Set the PublicAccess level to 'None':
try:
    container_client.set_access_policy(PublicAccess.NONE)
    print("Public access has been removed from the container.")
except ResourceExistsError:
    print("The container already has PublicAccess.NONE.")
  1. Verify that the PublicAccess level has been set to 'None':
container_properties = container_client.get_container_properties()
print("Public access level: ", container_properties.public_access)

This will ensure that the Storage Account container containing the logs is not publicly accessible.

Using Terraform
resource "azurerm_storage_account" "LOG_STORAGE_ACCOUNT" {
  name                     = "LOG_STORAGE_ACCOUNT_NAME"   # replace with your storage account name
  resource_group_name      = azurerm_resource_group.LOG_RG.name
  location                 = azurerm_resource_group.LOG_RG.location
  account_tier             = "Standard"
  account_replication_type = "LRS"

  # (other required settings)
}

resource "azurerm_storage_container" "LOG_CONTAINER" {
  name                  = "LOG_CONTAINER_NAME"            # replace with your logs container name
  storage_account_name  = azurerm_storage_account.LOG_STORAGE_ACCOUNT.name
  container_access_type = "private"                       # key setting: disables public access
}

resource "azurerm_monitor_log_profile" "ACTIVITY_LOG_EXPORT" {
  name = "LOG_PROFILE_NAME"                               # replace with your log profile name

  categories = [
    "Write",
    "Delete",
    "Action",
  ]

  locations = [
    "global",
  ]

  retention_policy {
    enabled = true
    days    = 365
  }

  storage_account_id = azurerm_storage_account.LOG_STORAGE_ACCOUNT.id

  # (other log profile settings as needed)
}

Changing container_access_type from blob/container to private updates the container in place and does not force replacement. After editing, terraform plan should show an in-place update on azurerm_storage_container.LOG_CONTAINER changing container_access_type to "private" and no destructive changes to the log profile.

Additional Reading:​