home.social

#resourcegraph — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #resourcegraph, aggregated by home.social.

  1. TIL disabling public access to a storage account does not disable all public access in certain scenarios:
    "By design, access to a storage account from trusted services takes the highest precedence over other network access restrictions. If you set **Public network access** to **Disabled** after previously setting it to **Enabled from selected virtual networks and IP addresses**, any resource instances and exceptions that you previously configured, including Allow Azure services on the trusted services list to access this storage account, will remain in effect. As a result, those resources and services might still have access to the storage account."

    Reference: learn.microsoft.com/en-us/azur

    The settings for 'resource instances' and 'exceptions' can be seen in attached screenshot.

    Unfortunately, these settings are not visible any more once Public network access is set to disabled, which is why it is easy to miss this configuration. This azure resource graph query can help finding storage accounts that have public network access disabled but still allow Azure services and/or resource types:
    ```
    resources
    | where type =~ 'Microsoft.Storage/storageAccounts'
    | where properties.publicNetworkAccess =~ 'Disabled'
    | where (array_length(properties.networkAcls.resourceAccessRules) > 0
    or properties.networkAcls.bypass =~ 'AzureServices')
    ```
    #azure #storageaccount #resourcegraph

  2. Being able to use a log analytics workspace to create alerts on Azure resource graph queries is pretty neat.

    #azure #resourcegraph #loganalytics

  3. Being able to use a log analytics workspace to create alerts on Azure resource graph queries is pretty neat.

    #azure #resourcegraph #loganalytics

  4. Being able to use a log analytics workspace to create alerts on Azure resource graph queries is pretty neat.

    #azure #resourcegraph #loganalytics

  5. Being able to use a log analytics workspace to create alerts on Azure resource graph queries is pretty neat.

    #azure #resourcegraph #loganalytics

  6. So, here is a #PowerShell #ResourceGraph query to list all storage accounts and their #allowSharedKeyAccess settings:

    Search-AzGraph -Query "resources | where type =~ 'Microsoft.Storage/storageAccounts' | extend allowSharedKeyAccess = parse_json(properties).allowSharedKeyAccess | project subscriptionId, resourceGroup, name, allowSharedKeyAccess"

    #Azure #StorageAccount #SharedKeyAccess

    Ref: learn.microsoft.com/en-gb/azur

  7. I‘ve been writing a short post about how to use the Azure SDK for Python for querying Azure Resource Graph for available resource names. Feel free to check it out in case you‘re interested: dev.to/holger/azure-sdk-for-py #azure #python #resourcegraph #azurecloud