Azure Storage account is not configured with private endpoint connection misconfiguration detected i

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_33
Category - Subcategory	Public Exposure - VPC VCN VNet
Provider	AZURE
Severity	MEDIUM
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	7c773d6c-3225-4f0b-a020-661c48e414b4

Impact

This rule is designed to ensure that a storage account is properly configured with a private endpoint. The private endpoint facilitates a secure connection over a private network, rather than the public internet.

If a storage account is not configured with a private endpoint, it poses a security risk as it might be accessible over the public internet. Unauthorized third parties could potentially gain access to the stored data, which may contain sensitive or proprietary information. Hence, it's crucial for the storage account to be properly configured with a private endpoint to maintain network security and data privacy.

How to Fix

Resource: azurerm_storage_account, azurerm_private_endpoint

To fix this issue, configure your Azure storage account with a private endpoint.

In the above code, a private endpoint example_private_endpoint is configured for the storage account examplestoracc. The private_service_connection block connects the storage account to the private endpoint securely. The subresource_names item is set to blob to specify that the endpoint is for blob storage. Configuring a storage account with a private endpoint ensures that network traffic between the storage account and the endpoint remains within the Azure network, which significantly reduces the risk of data exfiltration. [source,go]

resource "azurerm_storage_account" "example" { name = "examplestoracc" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS"

enable_https_traffic_only = true }

resource "azurerm_private_endpoint" "example" { name = "example_private_endpoint" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name subnet_id = azurerm_subnet.example.id

private_service_connection { name = "example_psc" is_manual_connection = false private_connection_resource_id = azurerm_storage_account.example.id subresource_names = ["blob"] } }