Project: KICS (Provisioning / Security & Compliance)
File: 9073f073-5d60-4b46-b569-0d6baa80ed95.md

title: Storage Account Allows Default Network Access hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9073f073-5d60-4b46-b569-0d6baa80ed95 Query name: Storage Account Allows Default Network Access Platform: AzureResourceManager Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: 'Microsoft.Storage/storageAccounts' should force the use of HTTPS<br> ```json title="Positive test num. 1 - json file" hl_lines="41" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-06-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "networkAcls": { "defaultAction": "Allow" } } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ``` ```json title="Positive test num. 2 - json file" hl_lines="18" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "storageaccount1Positive2", "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2017-10-01", "tags": { "displayName": "storageaccount1" }, "location": "[resourceGroup().location]", "kind": "StorageV2", "sku": { "name": "Premium_LRS", "tier": "Premium" }, "properties": { } } ], "outputs": {} } ``` ```json title="Positive test num. 3 - json file" hl_lines="8" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "storageaccount1Positive3", "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2016-12-01", "tags": { "displayName": "storageaccount1" }, "location": "[resourceGroup().location]", "kind": "Storage", "sku": { "name": "Premium_LRS", "tier": "Premium" }, "properties": {} } ], "outputs": {} } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="43" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type":

"apiVersion": "2019-06-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "networkAcls": { "defaultAction": "Allow" } } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } }, "resourceGroup": "storageRG", "parameters": { "storageAccountType": { "value": "[parameters('storageAccountType')]" } } }, "kind": "template", "id": "/providers/Microsoft.Management/managementGroups/ContosoOnlineGroup/providers/Microsoft.Blueprint/blueprints/simpleBlueprint/artifacts/storageTemplate", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "storageTemplate" } ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="20" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "storageaccount1Positive2", "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2017-10-01", "tags": { "displayName": "storageaccount1" }, "location": "[resourceGroup().location]", "kind": "StorageV2", "sku": { "name": "Premium_LRS", "tier": "Premium" }, "properties": { } } ], "outputs": {} }, "resourceGroup": "storageRG", "parameters": { "storageAccountType": { "value": "[parameters('storageAccountType')]" } } }, "kind": "template", "id": "/providers/Microsoft.Management/managementGroups/ContosoOnlineGroup/providers/Microsoft.Blueprint/blueprints/simpleBlueprint/artifacts/storageTemplate", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "storageTemplate" } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="10" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "storageaccount1Positive3", "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2016-12-01", "tags": { "displayName": "storageaccount1" }, "location": "[resourceGroup().location]", "kind": "Storage", "sku": { "name": "Premium_LRS", "tier": "Premium" }, "properties": {} } ], "outputs": {} }, "resourceGroup": "storageRG", "parameters": { "storageAccountType": { "value": "[parameters('storageAccountType')]" } } }, "kind": "template", "id": "/providers/Microsoft.Management/managementGroups/ContosoOnlineGroup/providers/Microsoft.Blueprint/blueprints/simpleBlueprint/artifacts/storageTemplate", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "storageTemplate" } ``` </details> ```json title="Negative test num. 1 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "storageaccount1Negative1", "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2021-02-01", "tags": { "displayName": "storageaccount1" }, "location": "[resourceGroup().location]", "kind": "StorageV2", "sku": { "name": "Premium_LRS", "tier": "Premium" }, "properties": { "networkAcls": { "defaultAction": "Deny" } } } ], "outputs": {} } ``` ```json title="Negative test num. 2 - json file" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "storageaccount1Negative1", "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2021-02-01", "tags": { "displayName": "storageaccount1" }, "location": "[resourceGroup().location]", "kind": "StorageV2", "sku": { "name": "Premium_LRS", "tier": "Premium" }, "properties": { "networkAcls": { "defaultAction": "Deny" } } } ], "outputs": {} }, "resourceGroup": "storageRG", "parameters": { "storageAccountType": { "value": "[parameters('storageAccountType')]" } } }, "kind": "template", "id": "/providers/Microsoft.Management/managementGroups/ContosoOnlineGroup/providers/Microsoft.Blueprint/blueprints/simpleBlueprint/artifacts/storageTemplate", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "storageTemplate" } ```