Azure storage account has a blob container with public access misconfiguration detected in code

Azure storage account has a blob container with public access misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_190
Category - Subcategory	Public Exposure - Storage Buckets
Provider	AZURE
Severity	HIGH
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	c085d057-d5a4-4118-afdf-f653e6b47995

Impact

This policy identifies blob containers within an Azure storage account that allow anonymous/public access ('CONTAINER' or 'BLOB'). As a best practice, do not allow anonymous/public access to blob containers unless you have a very good reason. Instead, you should consider using a shared access signature token for providing controlled and time-limited access to blob containers. 'Public access level' allows you to grant anonymous/public read access to a container and the blobs within Azure blob storage. By doing so, you can grant read-only access to these resources without sharing your account key, and without requiring a shared access signature.

How to Fix

Resource:

• azurerm_storage_account

Arguments:

• allow_nested_items_to_be_public [source,go]

---

resource "azurerm_storage_account" "example" { name = "examplestoracc" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "LRS"

... other configurations ...

• allow_nested_items_to_be_public = false

... other configurations ...

}