Skip to main content

Blob Containers Allowing Public Access

More Info:​

Anonymous, public read access to a container and its blobs can be enabled in Azure Blob storage. It grants read-only access to these resources without sharing the account key, and without requiring a shared access signature. It is recommended not to provide anonymous access to blob containers until, and unless, it is strongly desired. A shared access signature token should be used for providing controlled and timed access to blob containers.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AZURE
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • GDPR
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Sure, here are the step-by-step instructions to remediate the issue of Blob Containers Allowing Public Access in Azure:

  1. Login to your Azure portal (https://portal.azure.com/).

  2. Navigate to the storage account that contains the Blob Container that has public access enabled.

  3. Click on the Blob Container that has public access enabled.

  4. Click on the "Access Policy" option from the left-hand menu.

  5. From the "Public access level" dropdown, select the option "Private (no anonymous access)".

  6. Click on the "Save" button to save the changes.

  7. Repeat the above steps for all Blob Containers that have public access enabled.

By following the above steps, you have successfully remediated the issue of Blob Containers Allowing Public Access in Azure.

Using CLI

The following are the step-by-step instructions to remediate the misconfiguration of Blob Containers Allowing Public Access in AZURE using AZURE CLI:

  1. Open the AZURE CLI in your terminal or command prompt.

  2. Login to your AZURE account using the following command:

    az login

  3. Once you are logged in, you need to identify the storage account that has the Blob Containers Allowing Public Access. You can list all the storage accounts in your subscription using the following command:

    az storage account list

  4. From the list of storage accounts, identify the one that has the Blob Containers Allowing Public Access and make a note of its name.

  5. Next, you need to list all the containers within the storage account using the following command:

    az storage container list --account-name <storage-account-name> --query "[].name"

    Replace <storage-account-name> with the name of the storage account that you identified in step 4.

  6. From the list of containers, identify the one that has public access and make a note of its name.

  7. To revoke public access to the container, you need to set the access level of the container to private using the following command:

    az storage container set-permission --account-name <storage-account-name> --name <container-name> --public-access off

    Replace <storage-account-name> with the name of the storage account that you identified in step 4 and <container-name> with the name of the container that you identified in step 6.

  8. Once you have executed the above command, public access to the container will be revoked and only authorized users will be able to access it.

  9. Verify that the public access has been revoked by listing the container again using the command in step 5. The output should show that the access level of the container is private.

By following these steps, you can remediate the misconfiguration of Blob Containers Allowing Public Access in AZURE using AZURE CLI.

Using Python

To remediate the issue of Blob Containers Allowing Public Access in Azure using Python, you can use the Azure Storage SDK for Python. Here are the steps to follow:

  1. Install the Azure Storage SDK for Python using the following command:

    pip install azure-storage-blob

  2. Use the following code to get a list of all the containers in your storage account:

    from azure.storage.blob import BlobServiceClient

    connection_string = "<your_connection_string>"
    blob_service_client = BlobServiceClient.from_connection_string(connection_string)

    container_names = []
    containers = blob_service_client.list_containers()
    for container in containers:
        container_names.append(container.name)

  3. Once you have a list of all the containers, you can iterate over them and set the public access level to None using the following code:

    from azure.storage.blob import PublicAccess

    for container_name in container_names:
        container_client = blob_service_client.get_container_client(container_name)
        container_client.set_container_access_policy(PublicAccess.None, public_access_duration=None)

  4. Finally, you can check if the public access has been removed by using the following code:

    for container_name in container_names:
        container_client = blob_service_client.get_container_client(container_name)
        container_properties = container_client.get_container_properties()
        public_access = container_properties.public_access
        if public_access != PublicAccess.None:
            print(f"Public access is still allowed for container {container_name}")

By following these steps, you can remediate the issue of Blob Containers Allowing Public Access in Azure using Python.

Using Terraform
resource "azurerm_storage_account" "THIS_ACCOUNT" {
  name                     = "STORAGE_ACCOUNT_NAME"        # replace with your storage account name
  resource_group_name      = "RESOURCE_GROUP_NAME"         # replace with your resource group
  location                 = "AZURE_REGION"                # e.g. eastus
  account_tier             = "Standard"
  account_replication_type = "LRS"

  # Key setting: disable public blob/container access at the account level
  allow_blob_public_access = false
}

# For each existing container that should not be publicly accessible:
resource "azurerm_storage_container" "THIS_CONTAINER" {
  name                  = "CONTAINER_NAME"                 # replace with your container name
  storage_account_name  = azurerm_storage_account.THIS_ACCOUNT.name

  # Key setting: no anonymous/public access to this container or its blobs
  public_access         = "None"
}

This change does not force replacement of the storage account or containers; Terraform will update them in place, but any existing anonymous access to the containers/blobs will stop working.

Verification: terraform plan should show an in-place update to azurerm_storage_account setting allow_blob_public_access from true (or null) to false, and for each azurerm_storage_container changing public_access to "None" (or confirming it is already "None").

Additional Reading:​