rules/findings/azure/storage/azure-storage-account-default-network-access-rule-allow.json
|
{
"provider": "Azure", "serviceType": "Storage Accounts", "serviceName": "Storage", "displayName": "Ensure Default Network Access Rule for Storage Accounts is Set to Deny", "description": "Restricting default network access helps to provide a new layer of security, since storage accounts accept connections from clients on any network. To limit access to selected networks, the default action must be changed.", "rationale": "Storage accounts should be configured to deny access to traffic from all networks (including internet traffic). Access can be granted to traffic from specific Azure Virtual networks, allowing a secure network boundary for specific applications to be built. Access can also be granted to public internet IP address ranges to enable connections from specific internet or on-premises clients. When network rules are configured, only applications from allowed networks can access a storage account. When calling from an allowed network, applications continue to require proper authorization (a valid access key or SAS token) to access the storage account.", "impact": "All allowed networks will need to be whitelisted on each specific network, creating administrative overhead. This may result in loss of network connectivity, so do not turn on for critical resources during business hours.", "remediation": { "text": "\r\n\t\t\t###### Remediate from Azure Portal \r\n\t\t\t1. Go to Storage Accounts. \r\n\t\t\t2. For each storage account, under Security + networking, click Networking. \r\n\t\t\t3. Click the Firewalls and virtual networks heading. \r\n\t\t\t4. Set Public network access to Enabled from selected virtual networks and IP addresses. \r\n\t\t\t5. Add rules to allow traffic from specific networks and IP addresses. \r\n\t\t\t6. Click Save. \r\n\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-2-define-and-implement-enterprise-segmentationseparation-of-duties-strategy", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-2-secure-cloud-native-services-with-network-controls" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "9.3.2.3", "profile": [ "Level 1" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "az_storage_accounts", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "properties.networkAcls.defaultAction", "eq", "Allow" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "name": "Name", "location": "Location", "ResourceGroupName": "ResourceGroupName", "properties.networkAcls.defaultAction": "Default ACL Action" }, "expandObject": null }, "table": "default", "decorate": [ { "itemName": "Default ACL Action", "itemValue": "allow", "className": "badge badge-danger badge-xl" } ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "name", "location", "ResourceGroupName", "networking" ], "expandObject": null, "limit": null }, "showGoToButton": "true", "showModalButton": "true", "directLink": null } }, "text": { "data": { "properties": { "name": "Name", "location": "Location", "ResourceGroupName": "ResourceGroupName", "properties.networkAcls.defaultAction": "Default ACL Action" }, "expandObject": null }, "status": { "keyName": ["name"], "message": "Ensure Default Network Access Rule for Storage Accounts is Set to Deny for {name}", "defaultMessage": "Ensure Default Network Access Rule for Storage Accounts is Set to Deny" }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "AzureStorageAccount" }, "onlyStatus": false } }, "idSuffix": "storage_accounts_default_network_access_rule_allow", "notes": [ ], "categories": [ ], "immutable_properties": [ "id" ], "id": "azure_storage_012" } |