lacework-global-533
Set Default Network Access Rule for Storage Accounts to Deny (Automated)
Profile Applicability
• Level 1
Description
Restricting default network access helps to provide a new layer of security, since storage accounts accept connections from clients on any network. To limit access to selected networks, change the default action.
Rationale
Storage accounts should be configured to deny access to traffic from all networks (including internet traffic). Access can be granted to traffic from specific Azure Virtual networks, allowing a secure network boundary for specific applications to be built. Access can also be granted to public internet IP address ranges to enable connections from specific internet or on-premises clients. When network rules are configured, only applications from allowed networks can access a storage account. When calling from an allowed network, applications continue to require proper authorization (a valid access key or SAS token) to access the storage account.
Impact
All allowed networks will need to be whitelisted on each specific network, creating administrative overhead. This may result in loss of network connectivity, so do not turn on for critical resources during business hours.
Audit
From Azure Console
- Go to Storage Accounts
- For each storage account, Click on the
Networking
blade. - Click the
Firewalls and virtual networks
heading. - Ensure that Allow access from
All networks
is not selected.
From Azure CLI
Ensure defaultAction
is not set to Allow
.
az storage account list --query '[*].networkRuleSet'
From Azure PowerShell
Connect-AzAccount
Set-AzContext -Subscription <subscription ID>
Get-AzStorageAccountNetworkRuleset -ResourceGroupName <resource group> -Name <storage account name> |Select-Object DefaultAction
PowerShell Result - Non-Compliant
DefaultAction : Allow
PowerShell Result - Compliant
DefaultAction : Deny
Remediation
From Azure Console
- Go to
Storage Accounts
. - For each storage account, click the
Networking
blade. - Click the
Firewalls and virtual networks
heading. - Ensure that you have elected to
allow access from Selected networks
. - Add rules to allow traffic from specific network.
- Click
Save
to apply your changes.
From Azure CLI
Use the below command to update default-action to Deny.
az storage account update --name <StorageAccountName> --resource-group <resourceGroupName> --default-action Deny
References
https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy#gs-2-define-and-implement-enterprise-segmentationseparation-of-duties-strategy
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-network-security#ns-2-secure-cloud-services-with-network-controls