rules/findings/azure/storage/azure-storage-account-trusted-ms-services-bypass.json
|
{
"provider": "Azure", "serviceType": "Storage Accounts", "serviceName": "Storage", "displayName": "Ensure \u0027Allow Azure services on the trusted services list to access this storage account\u0027 is Enabled for Storage Account Access", "description": "\r\n\t\t*NOTE*: This recommendation assumes that the `Public network access` parameter is set to `Enabled from selected virtual networks and IP addresses`. Please ensure the prerequisite recommendation has been implemented before proceeding: \r\n\t\t* Ensure Default Network Access Rule for Storage Accounts is Set to Deny \r\n\t\tSome Microsoft services that interact with storage accounts operate from networks that cannot be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules. These services will then use strong authentication to access the storage account. If the Allow trusted Microsoft services exception is enabled, the following services: Azure Backup, Azure Site Recovery, Azure DevTest Labs, Azure Event Grid, Azure Event Hubs, Azure Networking, Azure Monitor and Azure SQL Data Warehouse (when registered in the subscription), are granted access to the storage account. Turning on firewall rules for storage account will block access to incoming requests for data, including from other Azure services. This includes using the Portal, writing logs, etc. We can re-enable functionality. The customer can get access to services like Monitor, Networking, Hubs, and Event Grid by enabling \"Trusted Microsoft Services\" through exceptions. Also, Backup and Restore of Virtual Machines using unmanaged disks in storage accounts with network rules applied is supported via creating an exception.\r\n ", "rationale": "Turning on firewall rules for storage account will block access to incoming requests for data, including from other Azure services. This includes using the Portal, writing logs, etc. We can re-enable functionality. The customer can get access to services like Monitor, Networking, Hubs, and Event Grid by enabling `Trusted Microsoft Services` through exceptions. Also, Backup and Restore of Virtual Machines using unmanaged disks in storage accounts with network rules applied is supported via creating an exception.", "impact": "This creates authentication credentials for services that need access to storage resources so that services will no longer need to communicate via network request. There may be a temporary loss of communication as you set each Storage Account. It is recommended to not do this on mission-critical resources during business hours.", "remediation": { "text": "###### From Azure Console\r\n\t\t\t\t\t1. Go to `Storage Accounts`.\r\n\t\t\t\t\t2. For each storage account, Click on the settings menu called `Firewalls` and `virtual networks`.\r\n\t\t\t\t\t3. Ensure that you have elected to allow access from `Selected networks`.\r\n\t\t\t\t\t4. Enable check box for `Allow trusted Microsoft services to access this storage account`.\r\n\t\t\t\t\t5. Click Save to apply your changes", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security", "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-network-security#ns-1-implement-security-for-internal-traffic", "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-2-define-enterprise-segmentation-strategy" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "9.3.5", "profile": [ "Level 2" ] } ], "level": "low", "tags": [ ], "rule": { "path": "az_storage_accounts", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "networking.allowAzureServices", "eq", "False" ], [ "networking.allowAccessFromAllNetworks", "eq", "true" ] ], "operator":"or" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "name": "Name", "CreationTime": "Creation Time", "location": "Location", "networking.allowAzureServices": "Allow Azure services", "networking.allowAccessFromAllNetworks": "Allow Access From All Networks" }, "expandObject": null }, "table": "default", "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "name", "location", "ResourceGroupName", "networking" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "name": "Name", "CreationTime": "Creation Time", "location": "Location", "networking.allowAzureServices": "Allow Azure services", "networking.allowAccessFromAllNetworks": "Allow Access From All Networks" }, "expandObject": null }, "status": { "keyName": ["name"], "message": "Ensure \u0027Allow Azure services on the trusted services list to access this storage account\u0027 is Enabled for {name} Storage Account Access", "defaultMessage": "Ensure \u0027Allow Azure services on the trusted services list to access this storage account\u0027 is Enabled for Storage Account Access" }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "AzureStorageAccount" }, "onlyStatus": false } }, "idSuffix": "storage_accounts_trusted_ms_services_bypass", "notes": [ ], "categories": [ ], "immutable_properties": [ "id" ], "id": "azure_storage_015" } |