turbot/steampipe-mod-terraform-azure-compliance

Control: Ensure that 'Public access level' is set to Private for blob containers

Description

Disable anonymous access to blob containers and disallow blob public access on storage account.

Usage

Run the control in your terminal:

powerpipe control run terraform_azure_compliance.control.storage_account_blob_containers_public_access_private

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_azure_compliance.control.storage_account_blob_containers_public_access_private --share

SQL

This control uses a named query:

select
address as resource,
case
when (attributes_std -> 'allow_blob_public_access') is null then 'ok'
when (attributes_std -> 'allow_blob_public_access')::bool then 'alarm'
else 'ok'
end status,
split_part(address, '.', 2) || case
when (attributes_std -> 'allow_blob_public_access') is null then ' does not allow public access to the blobs'
when (attributes_std -> 'allow_blob_public_access')::bool then ' allows public access to all the blobs'
else ' does not allow public access to the blobs'
end || '.' reason
, path || ':' || start_line
from
terraform_resource
where
type = 'azurerm_storage_account';

Tags