Azure Audit Storageaccount Blob Public Access Allowed Fix

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the issue of Blob Containers Allowing Public Access in Azure:

Login to your Azure portal (https://portal.azure.com/).
Navigate to the storage account that contains the Blob Container that has public access enabled.
Click on the Blob Container that has public access enabled.
Click on the "Access Policy" option from the left-hand menu.
From the "Public access level" dropdown, select the option "Private (no anonymous access)".
Click on the "Save" button to save the changes.
Repeat the above steps for all Blob Containers that have public access enabled.

By following the above steps, you have successfully remediated the issue of Blob Containers Allowing Public Access in Azure.

Using CLI

The following are the step-by-step instructions to remediate the misconfiguration of Blob Containers Allowing Public Access in AZURE using AZURE CLI:

Open the AZURE CLI in your terminal or command prompt.
Login to your AZURE account using the following command:
```
az login
```
Once you are logged in, you need to identify the storage account that has the Blob Containers Allowing Public Access. You can list all the storage accounts in your subscription using the following command:
```
az storage account list
```
From the list of storage accounts, identify the one that has the Blob Containers Allowing Public Access and make a note of its name.
Next, you need to list all the containers within the storage account using the following command:
```
az storage container list --account-name <storage-account-name> --query "[].name"
```
Replace <storage-account-name> with the name of the storage account that you identified in step 4.
From the list of containers, identify the one that has public access and make a note of its name.
To revoke public access to the container, you need to set the access level of the container to private using the following command:
```
az storage container set-permission --account-name <storage-account-name> --name <container-name> --public-access off
```
Replace <storage-account-name> with the name of the storage account that you identified in step 4 and <container-name> with the name of the container that you identified in step 6.
Once you have executed the above command, public access to the container will be revoked and only authorized users will be able to access it.
Verify that the public access has been revoked by listing the container again using the command in step 5. The output should show that the access level of the container is private.

By following these steps, you can remediate the misconfiguration of Blob Containers Allowing Public Access in AZURE using AZURE CLI.

Using Python

To remediate the issue of Blob Containers Allowing Public Access in Azure using Python, you can use the Azure Storage SDK for Python. Here are the steps to follow:

Install the Azure Storage SDK for Python using the following command:
```
pip install azure-storage-blob
```

Use the following code to get a list of all the containers in your storage account:

from azure.storage.blob import BlobServiceClient

connection_string = "<your_connection_string>"
blob_service_client = BlobServiceClient.from_connection_string(connection_string)

container_names = []
containers = blob_service_client.list_containers()
for container in containers:
    container_names.append(container.name)

Once you have a list of all the containers, you can iterate over them and set the public access level to None using the following code:

from azure.storage.blob import PublicAccess

for container_name in container_names:
    container_client = blob_service_client.get_container_client(container_name)
    container_client.set_container_access_policy(PublicAccess.None, public_access_duration=None)

Finally, you can check if the public access has been removed by using the following code:

for container_name in container_names:
    container_client = blob_service_client.get_container_client(container_name)
    container_properties = container_client.get_container_properties()
    public_access = container_properties.public_access
    if public_access != PublicAccess.None:
        print(f"Public access is still allowed for container {container_name}")

By following these steps, you can remediate the issue of Blob Containers Allowing Public Access in Azure using Python.

Using Terraform

resource "azurerm_storage_account" "THIS_ACCOUNT" {
  name                     = "STORAGE_ACCOUNT_NAME"        # replace with your storage account name
  resource_group_name      = "RESOURCE_GROUP_NAME"         # replace with your resource group
  location                 = "AZURE_REGION"                # e.g. eastus
  account_tier             = "Standard"
  account_replication_type = "LRS"

  # Key setting: disable public blob/container access at the account level
  allow_blob_public_access = false
}

# For each existing container that should not be publicly accessible:
resource "azurerm_storage_container" "THIS_CONTAINER" {
  name                  = "CONTAINER_NAME"                 # replace with your container name
  storage_account_name  = azurerm_storage_account.THIS_ACCOUNT.name

  # Key setting: no anonymous/public access to this container or its blobs
  public_access         = "None"
}

This change does not force replacement of the storage account or containers; Terraform will update them in place, but any existing anonymous access to the containers/blobs will stop working.

Verification: terraform plan should show an in-place update to azurerm_storage_account setting allow_blob_public_access from true (or null) to false, and for each azurerm_storage_container changing public_access to "None" (or confirming it is already "None").

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation