Azure Storage Account storing Machine Learning workspace high business impact data is publicly acces

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_50
Category - Subcategory	Public Exposure - Storage Buckets
Provider	AZURE
Severity	HIGH
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	14d69eff-7a20-4709-9129-66c774d91dea

Impact

This rule checks whether Azure Storage Accounts for Machine Learning workspaces are publicly accessible. Public access to these accounts storing sensitive business data poses a significant security risk. Leaks or misuse could lead to financial and reputational damage. By ensuring private access, this rule safeguards data confidentiality and integrity.

How to Fix

Terraform

• Resource: azurerm_machine_learning_workspace,azurerm_storage_account
• Arguments: public_network_access_enabled,high_business_impact

  1. Block all network access using storage account network rules.
  2. Grant access only to authorized users by adding exceptions for specific IP addresses or ranges.

resource "azurerm_storage_account" "pass" {
  ...
  public_network_access_enabled = false
}

resource "azurerm_machine_learning_workspace" "pass2" {
  ...
  storage_account_id      = azurerm_storage_account.pass.id
  ...
  high_business_impact = true
}