Skip to main content

Storage Accounts Allowing Public Traffic

More Info:​

Restricting default network access helps to provide a new layer of security, since storage accounts accept connections from clients on any network. To limit access to selected networks, the default action must be changed.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • FedRAMP
  • GDPR
  • HITRUST CSF
  • ISO 27001
  • NIST CSF
  • PCI
  • SOC2
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the issue of storage accounts allowing public traffic in Azure, you can follow the below steps:

  1. Open the Azure Portal and navigate to the storage account that is allowing public traffic.
  2. Click on "Firewalls and virtual networks" under the "Settings" section in the left-hand menu.
  3. In the "Firewalls and virtual networks" tab, select "Selected networks" under the "Allow access from" section.
  4. Add the IP addresses or ranges that need access to the storage account.
  5. Under the "Network connectivity" section, select "Private endpoint" to restrict access to the storage account to only those clients that have a private endpoint in the same virtual network.
  6. Save the changes.

By following the above steps, you can remediate the issue of storage accounts allowing public traffic in Azure.

Using CLI

To remediate the issue of Azure Storage Accounts allowing public traffic, you can follow the below steps using Azure CLI:

  1. Open the Azure CLI in your terminal or command prompt.
  2. Login to your Azure account using the command az login.
  3. Once you are logged in, select the subscription that contains the storage account using the command az account set --subscription <subscription-id>.
  4. Identify the storage account that is allowing public traffic using the command az storage account list.
  5. Once you have identified the storage account, update the network access rule to deny public access using the command az storage account update --name <storage-account-name> --resource-group <resource-group-name> --default-action Deny.

Note: Replace <subscription-id>, <storage-account-name>, and <resource-group-name> with the actual values from your environment.

After executing the above command, the storage account will be updated to deny public access, and only authorized traffic will be allowed to access the storage account.

Using Python

To remediate the Azure storage accounts allowing public traffic misconfiguration using Python, you can use the Azure SDK for Python. Follow these steps:

  1. Install the Azure SDK for Python using pip:
pip install azure-storage-blob
  1. Import the necessary modules:
from azure.storage.blob import BlockBlobService, PublicAccess
  1. Initialize the BlockBlobService object with your storage account credentials:
account_name = '<your_account_name>'
account_key = '<your_account_key>'
service = BlockBlobService(account_name=account_name, account_key=account_key)
  1. Get a list of all containers in the storage account:
containers = service.list_containers()
  1. For each container, set the public access level to 'None':
for container in containers:
    service.set_container_acl(container.name, public_access=PublicAccess.None)
  1. Finally, verify that the public access level for all containers is set to 'None':
for container in containers:
    acl = service.get_container_acl(container.name)
    if acl.public_access != PublicAccess.None:
        print(f"Public access still enabled for container {container.name}")

That's it! With these steps, you should be able to remediate the Azure storage accounts allowing public traffic misconfiguration using Python.

Using Terraform
resource "azurerm_storage_account" "THIS_STORAGE_ACCOUNT" {
  name                     = "STORAGE_ACCOUNT_NAME"          # replace with your storage account name
  resource_group_name      = "RESOURCE_GROUP_NAME"           # replace with your resource group
  location                 = "AZURE_REGION"                  # e.g. "eastus"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  # Restrict public network access
  network_rules {
    default_action = "Deny"

    # Optionally allow trusted Azure services or specific networks:
    # bypass = ["AzureServices"]

    # Optionally allow specific IPs or ranges:
    # ip_rules = [
    #   "ALLOWED_IP_OR_CIDR_1",
    #   "ALLOWED_IP_OR_CIDR_2",
    # ]

    # Optionally allow specific VNets/subnets:
    # virtual_network_subnet_ids = [
    #   azurerm_subnet.ALLOWED_SUBNET_1.id,
    #   azurerm_subnet.ALLOWED_SUBNET_2.id,
    # ]
  }
}

This change does not force replacement of the storage account; it updates the network rules in place, but it can break existing public access if not paired with appropriate IP/VNet allow rules.

For verification, terraform plan should show the network_rules[0].default_action argument changing from "Allow" (or being added) to "Deny" for the target azurerm_storage_account.

Additional Reading:​