Project: KICS (Provisioning / Security & Compliance)
File: d855ced8-6157-448f-9f1d-f05a41d046f7.md

title: Default Azure Storage Account Network Access Is Too Permissive hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: d855ced8-6157-448f-9f1d-f05a41d046f7 Query name: Default Azure Storage Account Network Access Is Too Permissive Platform: AzureResourceManager Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: Make sure that your Azure Storage Account access is limited to those who require it.<br> ```json title="Positive test num. 1 - json file" hl_lines="13" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "[variables('storageApiVersion')]", "dependsOn": [], "kind": "Storage", "location": "[variables('computeLocation')]", "name": "positive1", "properties": { "networkAcls": { "defaultAction": "Allow" } }, "sku": { "name": "[parameters('supportLogStorageAccountType')]" }, "tags": {}, "type": "Microsoft.Storage/storageAccounts" } ] } ``` ```json title="Positive test num. 2 - json file" hl_lines="11" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "[variables('storageApiVersion')]", "dependsOn": [], "kind": "Storage", "location": "[variables('computeLocation')]", "name": "positive2", "properties": {}, "sku": { "name": "[parameters('supportLogStorageAccountType')]" }, "tags": {}, "type": "Microsoft.Storage/storageAccounts" } ] } ``` ```json title="Positive test num. 3 - json file" hl_lines="12" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "[variables('storageApiVersion')]", "dependsOn": [], "kind": "Storage", "location": "[variables('computeLocation')]", "name": "positive3", "properties": { "publicNetworkAccess": "Enabled" }, "sku": { "name": "[parameters('supportLogStorageAccountType')]" }, "tags": {}, "type": "Microsoft.Storage/storageAccounts" } ] } ``` ```json title="Negative test num. 1 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "[variables('storageApiVersion')]", "dependsOn": [], "kind": "Storage", "location": "[variables('computeLocation')]", "name": "negative1", "properties": { "publicNetworkAccess": "Disabled" }, "sku": { "name": "[parameters('supportLogStorageAccountType')]" }, "tags": {}, "type": "Microsoft.Storage/storageAccounts" } ] } ``` ```json title="Negative test num. 2 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "[variables('storageApiVersion')]", "dependsOn": [], "kind": "Storage", "location": "[variables('computeLocation')]", "name": "negative2", "properties": { "networkAcls": { "defaultAction": "Deny" } }, "sku": { "name": "[parameters('supportLogStorageAccountType')]" }, "tags": {}, "type": "Microsoft.Storage/storageAccounts" } ] } ```