#storageaccount — Public Fediverse posts

TIL disabling public access to a storage account does not disable all public access in certain scenarios:
"By design, access to a storage account from trusted services takes the highest precedence over other network access restrictions. If you set **Public network access** to **Disabled** after previously setting it to **Enabled from selected virtual networks and IP addresses**, any resource instances and exceptions that you previously configured, including Allow Azure services on the trusted services list to access this storage account, will remain in effect. As a result, those resources and services might still have access to the storage account."

Reference: https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#restrictions-and-considerations

The settings for 'resource instances' and 'exceptions' can be seen in attached screenshot.

Unfortunately, these settings are not visible any more once Public network access is set to disabled, which is why it is easy to miss this configuration. This azure resource graph query can help finding storage accounts that have public network access disabled but still allow Azure services and/or resource types:
```
resources
| where type =~ 'Microsoft.Storage/storageAccounts'
| where properties.publicNetworkAccess =~ 'Disabled'
| where (array_length(properties.networkAcls.resourceAccessRules) > 0
or properties.networkAcls.bypass =~ 'AzureServices')
```
#azure #storageaccount #resourcegraph

TIL disabling public access to a storage account does not disable all public access in certain scenarios:
"By design, access to a storage account from trusted services takes the highest precedence over other network access restrictions. If you set **Public network access** to **Disabled** after previously setting it to **Enabled from selected virtual networks and IP addresses**, any resource instances and exceptions that you previously configured, including Allow Azure services on the trusted services list to access this storage account, will remain in effect. As a result, those resources and services might still have access to the storage account."

Reference: https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#restrictions-and-considerations

The settings for 'resource instances' and 'exceptions' can be seen in attached screenshot.

Unfortunately, these settings are not visible any more once Public network access is set to disabled, which is why it is easy to miss this configuration. This azure resource graph query can help finding storage accounts that have public network access disabled but still allow Azure services and/or resource types:
```
resources
| where type =~ 'Microsoft.Storage/storageAccounts'
| where properties.publicNetworkAccess =~ 'Disabled'
| where (array_length(properties.networkAcls.resourceAccessRules) > 0
or properties.networkAcls.bypass =~ 'AzureServices')
```
#azure #storageaccount #resourcegraph

TIL disabling public access to a storage account does not disable all public access in certain scenarios:
"By design, access to a storage account from trusted services takes the highest precedence over other network access restrictions. If you set **Public network access** to **Disabled** after previously setting it to **Enabled from selected virtual networks and IP addresses**, any resource instances and exceptions that you previously configured, including Allow Azure services on the trusted services list to access this storage account, will remain in effect. As a result, those resources and services might still have access to the storage account."

Reference: https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#restrictions-and-considerations

The settings for 'resource instances' and 'exceptions' can be seen in attached screenshot.

Unfortunately, these settings are not visible any more once Public network access is set to disabled, which is why it is easy to miss this configuration. This azure resource graph query can help finding storage accounts that have public network access disabled but still allow Azure services and/or resource types:
```
resources
| where type =~ 'Microsoft.Storage/storageAccounts'
| where properties.publicNetworkAccess =~ 'Disabled'
| where (array_length(properties.networkAcls.resourceAccessRules) > 0
or properties.networkAcls.bypass =~ 'AzureServices')
```
#azure #storageaccount #resourcegraph

TIL disabling public access to a storage account does not disable all public access in certain scenarios:
"By design, access to a storage account from trusted services takes the highest precedence over other network access restrictions. If you set **Public network access** to **Disabled** after previously setting it to **Enabled from selected virtual networks and IP addresses**, any resource instances and exceptions that you previously configured, including Allow Azure services on the trusted services list to access this storage account, will remain in effect. As a result, those resources and services might still have access to the storage account."

Reference: https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#restrictions-and-considerations

The settings for 'resource instances' and 'exceptions' can be seen in attached screenshot.

Unfortunately, these settings are not visible any more once Public network access is set to disabled, which is why it is easy to miss this configuration. This azure resource graph query can help finding storage accounts that have public network access disabled but still allow Azure services and/or resource types:
```
resources
| where type =~ 'Microsoft.Storage/storageAccounts'
| where properties.publicNetworkAccess =~ 'Disabled'
| where (array_length(properties.networkAcls.resourceAccessRules) > 0
or properties.networkAcls.bypass =~ 'AzureServices')
```
#azure #storageaccount #resourcegraph

𝗛𝗼𝘄 𝘁𝗼 𝘀𝗲𝗰𝘂𝗿𝗲 𝗮 𝗙𝘂𝗻𝗰𝘁𝗶𝗼𝗻 𝗔𝗽𝗽?

𝚂̲𝚎̲𝚌̲𝚞̲𝚛̲𝚎̲ ̲𝚘̲𝚙̲𝚎̲𝚛̲𝚊̲𝚝̲𝚒̲𝚘̲𝚗̲

➡️Defender for Cloud for assessment of potential configuration-related security vulnerabilities

➡️Log and monitor: diagnostic settings to configure streaming export of platform logs and metrics

➡️Require HTTPS

➡️Securing keys with Azure key Vault

➡️Enable App Service Authentication/Authorization

➡️Use Azure API Management (APIM) to authenticate requests

➡️Run your function app with the lowest possible permissions

➡️Store data encrypted

𝚂̲𝚎̲𝚌̲𝚞̲𝚛̲𝚎̲ ̲𝚍̲𝚎̲𝚙̲𝚕̲𝚘̲𝚢̲𝚖̲𝚎̲𝚗̲𝚝̲

➡️Disable FTP

➡️Secure the scm endpoint

𝙽̲𝚎̲𝚝̲𝚠̲𝚘̲𝚛̲𝚔̲ ̲𝚜̲𝚎̲𝚌̲𝚞̲𝚛̲𝚒̲𝚝̲𝚢̲

➡️Set access restrictions

➡️Secure the storage account

➡️Private site access with Azure Private Endpoint

➡️Deploy your function app in isolation configuring a Web Application Firewall (WAF) for App Service Environment.

More details: https://learn.microsoft.com/en-us/azure/azure-functions/security-concepts?tabs=v4

#security #azure #cloud #data #management #streaming #functionapp #serverless #waf #appservice #privateendpoint #networksecurity #securedeployment #apim #ftp #keyvault #key #vulnerability #assessment #misconfiguration #encryption #storage #storageaccount #defender #defenderforcloud #cnapp #cspm #cwpp #microsoft #microsoftsecurity #cloudsecurity #cloudnative #siem #monitoring #soc

𝗛𝗼𝘄 𝘁𝗼 𝘀𝗲𝗰𝘂𝗿𝗲 𝗮 𝗙𝘂𝗻𝗰𝘁𝗶𝗼𝗻 𝗔𝗽𝗽?

𝚂̲𝚎̲𝚌̲𝚞̲𝚛̲𝚎̲ ̲𝚘̲𝚙̲𝚎̲𝚛̲𝚊̲𝚝̲𝚒̲𝚘̲𝚗̲

➡️Defender for Cloud for assessment of potential configuration-related security vulnerabilities

➡️Log and monitor: diagnostic settings to configure streaming export of platform logs and metrics

➡️Require HTTPS

➡️Securing keys with Azure key Vault

➡️Enable App Service Authentication/Authorization

➡️Use Azure API Management (APIM) to authenticate requests

➡️Run your function app with the lowest possible permissions

➡️Store data encrypted

𝚂̲𝚎̲𝚌̲𝚞̲𝚛̲𝚎̲ ̲𝚍̲𝚎̲𝚙̲𝚕̲𝚘̲𝚢̲𝚖̲𝚎̲𝚗̲𝚝̲

➡️Disable FTP

➡️Secure the scm endpoint

𝙽̲𝚎̲𝚝̲𝚠̲𝚘̲𝚛̲𝚔̲ ̲𝚜̲𝚎̲𝚌̲𝚞̲𝚛̲𝚒̲𝚝̲𝚢̲

➡️Set access restrictions

➡️Secure the storage account

➡️Private site access with Azure Private Endpoint

➡️Deploy your function app in isolation configuring a Web Application Firewall (WAF) for App Service Environment.

More details: https://learn.microsoft.com/en-us/azure/azure-functions/security-concepts?tabs=v4

#security #azure #cloud #data #management #streaming #functionapp #serverless #waf #appservice #privateendpoint #networksecurity #securedeployment #apim #ftp #keyvault #key #vulnerability #assessment #misconfiguration #encryption #storage #storageaccount #defender #defenderforcloud #cnapp #cspm #cwpp #microsoft #microsoftsecurity #cloudsecurity #cloudnative #siem #monitoring #soc

So, here is a #PowerShell #ResourceGraph query to list all storage accounts and their #allowSharedKeyAccess settings:

Search-AzGraph -Query "resources | where type =~ 'Microsoft.Storage/storageAccounts' | extend allowSharedKeyAccess = parse_json(properties).allowSharedKeyAccess | project subscriptionId, resourceGroup, name, allowSharedKeyAccess"

#Azure #StorageAccount #SharedKeyAccess

Ref: https://learn.microsoft.com/en-gb/azure/storage/common/shared-key-authorization-prevent

So, here is a #PowerShell #ResourceGraph query to list all storage accounts and their #allowSharedKeyAccess settings:

Search-AzGraph -Query "resources | where type =~ 'Microsoft.Storage/storageAccounts' | extend allowSharedKeyAccess = parse_json(properties).allowSharedKeyAccess | project subscriptionId, resourceGroup, name, allowSharedKeyAccess"

#Azure #StorageAccount #SharedKeyAccess

Ref: https://learn.microsoft.com/en-gb/azure/storage/common/shared-key-authorization-prevent

So, here is a #PowerShell #ResourceGraph query to list all storage accounts and their #allowSharedKeyAccess settings:

Search-AzGraph -Query "resources | where type =~ 'Microsoft.Storage/storageAccounts' | extend allowSharedKeyAccess = parse_json(properties).allowSharedKeyAccess | project subscriptionId, resourceGroup, name, allowSharedKeyAccess"

#Azure #StorageAccount #SharedKeyAccess

Ref: https://learn.microsoft.com/en-gb/azure/storage/common/shared-key-authorization-prevent