> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Storage Accounts Allowing Public Traffic

### More Info:

Restricting default network access helps to provide a new layer of security, since storage accounts accept connections from clients on any network. To limit access to selected networks, the default action must be changed.

### Risk Level

Medium

### Address

Security

### Compliance Standards

GDPR, ISO27001, HITRUST, SOC2, NISTCSF, PCIDSS, FedRAMP

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the issue of storage accounts allowing public traffic in Azure, you can follow the below steps:

        1. Open the Azure Portal and navigate to the storage account that is allowing public traffic.
        2. Click on "Firewalls and virtual networks" under the "Settings" section in the left-hand menu.
        3. In the "Firewalls and virtual networks" tab, select "Selected networks" under the "Allow access from" section.
        4. Add the IP addresses or ranges that need access to the storage account.
        5. Under the "Network connectivity" section, select "Private endpoint" to restrict access to the storage account to only those clients that have a private endpoint in the same virtual network.
        6. Save the changes.

        By following the above steps, you can remediate the issue of storage accounts allowing public traffic in Azure.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the issue of Azure Storage Accounts allowing public traffic, you can follow the below steps using Azure CLI:

        1. Open the Azure CLI in your terminal or command prompt.
        2. Login to your Azure account using the command `az login`.
        3. Once you are logged in, select the subscription that contains the storage account using the command `az account set --subscription <subscription-id>`.
        4. Identify the storage account that is allowing public traffic using the command `az storage account list`.
        5. Once you have identified the storage account, update the network access rule to deny public access using the command `az storage account update --name <storage-account-name> --resource-group <resource-group-name> --default-action Deny`.

        Note: Replace `<subscription-id>`, `<storage-account-name>`, and `<resource-group-name>` with the actual values from your environment.

        After executing the above command, the storage account will be updated to deny public access, and only authorized traffic will be allowed to access the storage account.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the Azure storage accounts allowing public traffic misconfiguration using Python, you can use the Azure SDK for Python. Follow these steps:

        1. Install the Azure SDK for Python using pip:

        ```
        pip install azure-storage-blob
        ```

        2. Import the necessary modules:

        ```python theme={null}
        from azure.storage.blob import BlockBlobService, PublicAccess
        ```

        3. Initialize the BlockBlobService object with your storage account credentials:

        ```python theme={null}
        account_name = '<your_account_name>'
        account_key = '<your_account_key>'
        service = BlockBlobService(account_name=account_name, account_key=account_key)
        ```

        4. Get a list of all containers in the storage account:

        ```python theme={null}
        containers = service.list_containers()
        ```

        5. For each container, set the public access level to 'None':

        ```python theme={null}
        for container in containers:
            service.set_container_acl(container.name, public_access=PublicAccess.None)
        ```

        6. Finally, verify that the public access level for all containers is set to 'None':

        ```python theme={null}
        for container in containers:
            acl = service.get_container_acl(container.name)
            if acl.public_access != PublicAccess.None:
                print(f"Public access still enabled for container {container.name}")
        ```

        That's it! With these steps, you should be able to remediate the Azure storage accounts allowing public traffic misconfiguration using Python.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security](https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security)