Project: KICS (Provisioning / Security & Compliance)
File: 17f75827-0684-48f4-8747-61129c7e4198.md

title: Public Storage Account hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 17f75827-0684-48f4-8747-61129c7e4198 Query name: Public Storage Account Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: Storage Account should not be public to grant the principle of least privileges<br> ```tf title="Positive test num. 1 - tf file" hl_lines="48 43 11 28" resource "azurermstorageaccount" "positive1" { name = "storageaccountname" resourcegroupname = azurermresourcegroup.example.name location = azurermresourcegroup.example.location account_tier = "Standard" accountreplicationtype = "LRS" network_rules { default_action = "Deny" ip_rules = ["0.0.0.0/0"] virtualnetworksubnetids = [azurermsubnet.example.id] } tags = { environment = "staging" } } resource "azurermstorageaccount" "positive2" { name = "storageaccountname" resourcegroupname = azurermresourcegroup.example.name location = azurermresourcegroup.example.location account_tier = "Standard" accountreplicationtype = "LRS" network_rules { default_action = "Allow" virtualnetworksubnetids = [azurermsubnet.example.id] } tags = { environment = "staging" } } resource "azurermstorageaccountnetworkrules" "positive3" { resourcegroupname = azurermresourcegroup.test.name storageaccountname = azurermstorageaccount.test.name default_action = "Allow" ip_rules = ["0.0.0.0/0"] virtualnetworksubnetids = [azurermsubnet.test.id] bypass = ["Metrics"] } resource "azurermstorageaccountnetworkrules" "positive4" { resourcegroupname = azurermresourcegroup.test.name storageaccountname = azurermstorageaccount.test.name default_action = "Allow" virtualnetworksubnetids = [azurermsubnet.test.id] bypass = ["Metrics"] } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="8" resource "azurermstorageaccount" "positive5" { name = "storageaccountname" resourcegroupname = azurermresourcegroup.example.name location = azurermresourcegroup.example.location account_tier = "Standard" accountreplicationtype = "GRS" allowblobpublic_access = true } ``` ```tf title="Negative test num. 1 - tf file" resource "azurermstorageaccount" "negative1" { name = "storageaccountname" resourcegroupname = azurermresourcegroup.example.name location = azurermresourcegroup.example.location account_tier = "Standard" accountreplicationtype = "LRS" network_rules { default_action = "Deny" ip_rules = ["100.0.0.1"] virtualnetworksubnetids = [azurermsubnet.example.id] } tags = { environment = "staging" } } resource "azurermstorageaccountnetworkrules" "negative2" { resourcegroupname = azurermresourcegroup.test.name storageaccountname = azurermstorageaccount.test.name default_action = "Allow" ip_rules = ["127.0.0.1"] virtualnetworksubnetids = [azurermsubnet.test.id] bypass = ["Metrics"] } ``` ```tf title="Negative test num. 2 - tf file" resource "azurermstorageaccount" "negative5" { name = "storageaccountname" resourcegroupname = azurermresourcegroup.example.name location = azurermresourcegroup.example.location account_tier = "Standard" accountreplicationtype = "GRS" allowblobpublic_access = false } ``` ```tf title="Negative test num. 3 - tf file" resource "azurermstorageaccount" "negative6" { name = "storageaccountname" resourcegroupname = azurermresourcegroup.example.name location = azurermresourcegroup.example.location account_tier = "Standard" accountreplicationtype = "GRS" } ```