Disable public access to storage accounts with blob containers

Risk Level: Medium (should be achieved)

Rule ID: StorageAccounts-022

Ensure that public (anonymous) access is disabled for all the blob containers available within your Microsoft Azure storage accounts in order to protect your data against unauthorized access. Disabling public access at the storage account level overrides the public access setting configured for the individual blob containers in that storage account.

This rule resolution is part of the Conformity Security & Compliance tool for Azure.

Security

A user that is able to access blob containers anonymously can use constructors that don't require credentials such as shared access signatures. Trend Micro Cloud One™ – Conformity strongly recommends disabling anonymous access to all the blob containers provisioned within your Azure storage accounts, unless it is really required. To follow security best practices and keep your data safe and secure in Azure cloud, ensure that your blob containers are not publicly exposed.

Audit

To determine if your storage blob containers are publicly accessible, perform the following actions:

Using Azure Portal

01 Sign in to the Azure Management Console.

02 Navigate to All resources blade at https://portal.azure.com/#blade/HubsExtension/BrowseAll to view all your Microsoft Azure cloud resources.

03 From the Subscription equals filter box, select the Azure account subscription that you want to examine.

04 From the Type equals filter box, select Storage account and choose Apply to list only the storage accounts provisioned in your Azure account.

05 Click on the name (link) of the storage account that you want to examine.

06 In the resource navigation panel, under Settings, choose Configuration to access the configuration settings available for the selected storage account.

07 Check the configuration value set for the Allow Blob public access setting. If Allow Blob public access is set to Enabled, all container and blob data can be read by anonymous users, therefore the public access to the blob containers within the selected Azure storage account is not disabled.

08 Repeat steps no. 5 – 7 for each storage account available within the selected subscription.

09 Repeat steps no. 3 – 8 for each subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Run storage account list command (Windows/macOS/Linux) with custom query filters to describe the identifier (ID) of each storage account provisioned in the current subscription:

az storage account list
  --query '[*].id'

02 The command output should return the requested storage account IDs:

[
  "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Storage/storageAccounts/abcdabcdabcd123412341234",
  "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Storage/storageAccounts/abcd1234abcd1234abcd1234"
]

03 Run storage account show command (Windows/macOS/Linux) using the ID of the Azure storage account that you want to examine as the identifier parameter to describe the public access status available for the blob containers within the selected storage account:

az storage account show
  --ids "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Storage/storageAccounts/abcdabcdabcd123412341234"
  --query allowBlobPublicAccess

04 The command output should return the requested configuration status (true for enabled, false for disabled)

true

If the storage account show command output returns true, as shown in the example above, the container and blob data can be read by anonymous users, therefore the public access to the blob containers in the selected Azure storage account is not disabled.

05 Repeat steps no. 3 and 4 for each storage account available within the selected subscription.

06 Repeat steps no. 1 – 5 for each subscription created in your Microsoft Azure cloud account.

Remediation / Resolution

Case A: To disable public (anonymous) access to all the blob containers within your Microsoft Azure storage accounts, perform the following actions:

Using Azure Portal

01 Sign in to the Azure Management Console.

02 Navigate to All resources blade at https://portal.azure.com/#blade/HubsExtension/BrowseAll to view all your Microsoft Azure cloud resources.

03 From the Subscription equals filter box, select the Azure account subscription that you want to examine.

04 From the Type equals filter box, select Storage account and choose Apply to list only the storage accounts provisioned in your Azure account.

05 Click on the name of the storage account that you want to reconfigure.

06 In the navigation panel, under Settings, choose Configuration to access the configuration settings available for the selected resource.

07 Select Disabled under Allow Blob public access to disable public access to blob containers at the storage account level. Choose Save to apply the changes.

08 Repeat steps no. 5 – 7 for each storage account available within the selected subscription.

09 Repeat steps no. 3 – 8 for each subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Run az storage account update command (Windows/macOS/Linux) using the ID of the Azure storage account that you want to reconfigure as the identifier parameter, to disable public access to all blobs or containers in the selected storage account:

az storage account update
  --ids "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Storage/storageAccounts/abcdabcdabcd123412341234"
  --allow-blob-public-access false

02 Repeat step no. 1 for each storage account available in the current Azure subscription.

03 Repeat steps no. 1 and 2 for each subscription created in your Microsoft Azure cloud account.

Case B: To disable public access to certain containers within your Microsoft Azure storage account, perform the following operations:

Using Azure Portal

01 Sign in to the Azure Management Console.

02 Navigate to All resources blade at https://portal.azure.com/#blade/HubsExtension/BrowseAll to view all your Microsoft Azure cloud resources.

03 From the Subscription equals filter box, select the Azure account subscription that you want to examine.

04 From the Type equals filter box, select Storage account and choose Apply to list only the storage accounts provisioned in your Azure account.

05 Click on the name of the storage account that you want to access.

06 In the navigation panel, under Data storage, choose Containers to access the blob containers provisioned in your storage account.

07 Select the container that you want to reconfigure and choose Change access level.

08 On the Change access level configuration panel, select Private (no anonymous access) option from the Public access level dropdown list to disable anonymous access for the selected blob container. Choose Ok to confirm the change.

09 Repeat steps no. 7 and 8 for all publicly accessible containers available in the selected storage account.

10 Repeat steps no. 5 – 9 for each storage account available within the selected subscription.

11 Repeat steps no. 3 – 10 for each subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Run storage container set-permission command (Windows/macOS/Linux) using the name of the blob container that you want to reconfigure as the identifier parameter to disable public access to the selected blob container by setting the "Public access level" configuration option to "Private (no anonymous access)":

az storage container set-permission
  --name cc-project5-container
  --account-name abcdabcdabcd123412341234
  --public-access off

02 Repeat step no. 1 for all publicly accessible containers available in the selected storage account.

03 Repeat step no. 1 and 2 for each storage account available in the current Azure subscription.

04 Repeat step no. 1 – 3 for each subscription created in your Microsoft Azure cloud account.

References

Azure Official Documentation
Configure anonymous public read access for containers and blobs
Remediate anonymous public read access to blob data (Azure Resource Manager deployments)

Azure Command Line Interface (CLI) Documentation
az
az storage account list
az storage container list
az storage container show
az storage container set-permission
az storage account show
az storage account update

Publication date Oct 18, 2022

Unlock the Remediation Steps

Free 30-day Trial

Automatically audit your configurations with Conformity
and gain access to our cloud security platform.

No thanks, back to article

You are auditing:

Disable public access to storage accounts with blob containers

Risk Level: Medium

Audit

Using Azure Portal

Using Azure CLI

Remediation / Resolution

Using Azure Portal

Using Azure CLI

Using Azure Portal

Using Azure CLI

References

Related StorageAccounts rules