Control: 9.3.2.3 Ensure default network access rule for storage accounts is set to deny

Description

Restricting default network access helps to provide a new layer of security, since storage accounts accept connections from clients on any network. To limit access to selected networks, the default action must be changed.

NOTE: This recommendation is only applicable if Public Network Access has not been disabled due to necessity or exception.

Storage accounts should be configured to deny access to traffic from all networks (including internet traffic). Access can be granted to traffic from specific Azure Virtual networks, allowing a secure network boundary for specific applications to be built. Access can also be granted to public internet IP address ranges to enable connections from specific internet or on-premises clients. When network rules are configured, only applications from allowed networks can access a storage account. When calling from an allowed network, applications continue to require proper authorization (a valid access key or SAS token) to access the storage account.

Remediation

Remediate from Azure Portal

Go to Storage Accounts.
For each storage account, under Security + networking, click Networking.
Click the Firewalls and virtual networks heading.
Set Public network access to Enabled from selected virtual networks and IP addresses.
Add rules to allow traffic from specific networks and IP addresses.
Click Save.

Remediate from Azure CLI

Use the below command to update default-action to Deny.

az storage account update --name <StorageAccountName> --resource-group <resourceGroupName> --default-action Deny

Default Value

By default, Storage Accounts will accept connections from clients on any network.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v500_9_3_2_3

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v500_9_3_2_3 --share

SQL

This control uses a named query:

select
  sa.id as resource,
  case
    when network_rule_default_action = 'Deny' then 'ok'
    else 'alarm'
  end as status,
  case
    when network_rule_default_action = 'Deny' then sa.name || ' default network access rule set to deny.'
    else sa.name || ' default network access rule not set to deny.'
  end as reason
  
  , sa.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_storage_account sa
  left join azure_subscription sub on sub.subscription_id = sa.subscription_id;