Azure Storage Account default network access is set to 'Allow' misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_35
Category - Subcategory	Public Exposure - Storage Buckets
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	0c8ba0ca-2414-4d62-897c-4b57a291ae2b

Impact

Restricting default network access helps to provide an additional layer of security. By default, storage accounts accept connections from clients on any network. To limit access to selected networks, the default action must be changed. We recommend you configure storage accounts to deny access to traffic from all networks, including internet traffic. At an appropriate time, access can be granted to traffic from specific Azure Virtual networks, allowing a secure network boundary for specific applications to be built. Access can also be granted to public internet IP address ranges enabling connections from specific internet or on-premises clients. When network rules are configured only applications from allowed networks can access a storage account. When calling from an allowed network applications continue to require authorization, such as a valid access key or SAS token, to access the storage account.

How to Fix

Resource: azurerm_storage_account_network_rules

• Arguments: default_action

In a Storage Account:

Suppression Advice

This can trigger incorrectly on azurerm_storage_account when using correctly configured azurerm_storage_account_network_rules, if this occurs suppression is reasonable. [source,go]

resource "azurerm_storage_account_network_rules" "test" { resource_group_name = azurerm_resource_group.test.name storage_account_name = azurerm_storage_account.test.name

• default_action = "Deny" }

---

resource "azurerm_storage_account" "test" { name = var.watcher resource_group_name = azurerm_resource_group.test.name location = azurerm_resource_group.test.location

• network_rules {
• default_action="Deny"
• }

account_tier = "Standard" account_kind = "StorageV2" account_replication_type = "LRS" enable_https_traffic_only = true }