Blob Containers Allowing Public Access

More Info:

Anonymous, public read access to a container and its blobs can be enabled in Azure Blob storage. It grants read-only access to these resources without sharing the account key, and without requiring a shared access signature. It is recommended not to provide anonymous access to blob containers until, and unless, it is strongly desired. A shared access signature token should be used for providing controlled and timed access to blob containers.

Risk Level

Medium

Address

Security

Compliance Standards

SOC2, ISO27001, GDPR, CISAZURE, CBP, NISTCSF

Triage and Remediation

Remediation

Using Console

Using CLI

The following are the step-by-step instructions to remediate the misconfiguration of Blob Containers Allowing Public Access in AZURE using AZURE CLI:

Open the AZURE CLI in your terminal or command prompt.
Login to your AZURE account using the following command:
```
az login
```
Once you are logged in, you need to identify the storage account that has the Blob Containers Allowing Public Access. You can list all the storage accounts in your subscription using the following command:
```
az storage account list
```
From the list of storage accounts, identify the one that has the Blob Containers Allowing Public Access and make a note of its name.
Next, you need to list all the containers within the storage account using the following command:
```
az storage container list --account-name <storage-account-name> --query "[].name"
```
Replace <storage-account-name> with the name of the storage account that you identified in step 4.
From the list of containers, identify the one that has public access and make a note of its name.
To revoke public access to the container, you need to set the access level of the container to private using the following command:
```
az storage container set-permission --account-name <storage-account-name> --name <container-name> --public-access off
```
Replace <storage-account-name> with the name of the storage account that you identified in step 4 and <container-name> with the name of the container that you identified in step 6.
Once you have executed the above command, public access to the container will be revoked and only authorized users will be able to access it.
Verify that the public access has been revoked by listing the container again using the command in step 5. The output should show that the access level of the container is private.

By following these steps, you can remediate the misconfiguration of Blob Containers Allowing Public Access in AZURE using AZURE CLI.

Using Python

To remediate the issue of Blob Containers Allowing Public Access in Azure using Python, you can use the Azure Storage SDK for Python. Here are the steps to follow:

Install the Azure Storage SDK for Python using the following command:
```
pip install azure-storage-blob
```

Use the following code to get a list of all the containers in your storage account:

from azure.storage.blob import BlobServiceClient

connection_string = "<your_connection_string>"
blob_service_client = BlobServiceClient.from_connection_string(connection_string)

container_names = []
containers = blob_service_client.list_containers()
for container in containers:
    container_names.append(container.name)

Once you have a list of all the containers, you can iterate over them and set the public access level to None using the following code:

from azure.storage.blob import PublicAccess

for container_name in container_names:
    container_client = blob_service_client.get_container_client(container_name)
    container_client.set_container_access_policy(PublicAccess.None, public_access_duration=None)

Finally, you can check if the public access has been removed by using the following code:

for container_name in container_names:
    container_client = blob_service_client.get_container_client(container_name)
    container_properties = container_client.get_container_properties()
    public_access = container_properties.public_access
    if public_access != PublicAccess.None:
        print(f"Public access is still allowed for container {container_name}")

By following these steps, you can remediate the issue of Blob Containers Allowing Public Access in Azure using Python.

Additional Reading:

https://docs.microsoft.com/en-us/azure/storage/blobs/storage-manage-access-to-resources

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Blob Containers Allowing Public Access

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading: