Azure-StorageAccounts-Network-Access-Default-Action

Severity : High

Description: This control ensures that default network access rule for Storage Accounts is set to deny. Restricting default network access helps to provide a new layer of security, since storage accounts accept connections from clients on any network. Access can be granted to traffic from specific Azure Virtual networks, allowing a secure network boundary for specific applications to be built. To limit access to selected networks, the default action must be changed.

Remediation Steps:

Perform following to update Storage account access rules:

1. Login to Azure Portal using https://portal.azure.com.

2. Go to Storage Accounts.

3. For each storage account, click on the Networking  under Settings

4. Go to Firewalls and virtual networks tab.

5. Ensure that you have elected to allow access from Selected networks.

6. Add rules to Allow traffic from Specific network.

7. Click Save to apply your changes.

Important:

Reference:

• CIS Microsoft Azure Foundations Benchmark v1.3.0 - 02-01-2021 : Recommendation #3.6

• https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security