Control: 3.7 Ensure 'Trusted Microsoft Services' is enabled for Storage Account access

Description

Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules. These services will then use strong authentication to access the storage account. If the Allow trusted Microsoft services exception is enabled, the following services: Azure Backup, Azure Site Recovery, Azure DevTest Labs, Azure Event Grid, Azure Event Hubs, Azure Networking, Azure Monitor and Azure SQL Data Warehouse (when registered in the subscription), are granted access to the storage account.

Turning on firewall rules for storage account will block access to incoming requests for data, including from other Azure services. This includes using the Portal, writing logs, etc. We can re-enable functionality. The customer can get access to services like Monitor, Networking, Hubs, and Event Grid by enabling "Trusted Microsoft Services" through exceptions. Also, Backup and Restore of Virtual Machines using unmanaged disks in storage accounts with network rules applied is supported via creating an exception.

Remediation

From Console

Login to Azure Storage Accounts
For each storage account, go to Security + networking section
Click on the Networking settings
Go to menu called Firewalls and virtual networks
Ensure that you have elected to allow access from Selected networks
In Exceptions section, enable check box for Allow trusted Microsoft services to access this storage account
Click Save to apply your changes.

From Command Line

Use the below command to update trusted Microsoft services.

 az storage account update --name <StorageAccountName> --resource-group <resourceGroupName> --bypass AzureServices

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v140_3_7

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v140_3_7 --share

SQL

This control uses a named query:

select
  sa.id as resource,
  case
    when network_rule_bypass not like '%AzureServices%' then 'alarm'
    else 'ok'
  end as status,
  case
    when network_rule_bypass not like '%AzureServices%' then sa.name || ' trusted Microsoft services not enabled.'
    else sa.name || ' trusted Microsoft services enabled.'
  end as reason
  
  , sa.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_storage_account sa,
  azure_subscription sub
where
  sub.subscription_id = sa.subscription_id;