Azure Storage Sync Service configured with overly permissive network access misconfiguration detecte

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_250
Category	Networking
Provider	AZURE
Severity	HIGH
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	3c244889-e2d5-4f56-93cc-4cd135ccce47

Impact

Azure Storage Sync Services with public network access are vulnerable to unauthorized access. Malicious actors could exploit this misconfiguration to gain entry and potentially compromise the entire network.

The Storage Sync Service manages registered servers and sync groups. Public network access exposes the service to brute-force attacks and other exploitation attempts from untrusted IPs. This bypasses network security controls, increasing the risk of data breaches and lateral movement within the environment.

Compromise could lead to data exfiltration, service disruption, and significant financial losses. Restricting network access to authorized entities only, using private endpoints, minimizes the attack surface and improves the overall security posture.

Implement private endpoints for Storage Sync Services. Restrict network access to only trusted IP addresses or virtual networks. Regularly review and update network configurations to maintain a strong security posture and prevent unauthorized access.

How to Fix

Ensure that the incoming_traffic_policy for your Azure Storage Sync Service is configured with the least privilege network access and not set to AllowAllTraffic. [source,go]

resource "azurerm_storage_sync" "example" { ...

• incoming_traffic_policy = "AllowAllTraffic" }

---