70 lines
2.3 KiB
YAML
70 lines
2.3 KiB
YAML
id: azure-storage-public-access
|
|
info:
|
|
name: Azure Storage Publicly Accessible Web Containers
|
|
author: princechaddha
|
|
severity: high
|
|
description: |
|
|
Ensure that the Microsoft Azure storage container where the exported activity log files are saved is not publicly accessible from the Internet, in order to avoid exposing sensitive data and minimize security risks.
|
|
impact: |
|
|
If the storage container is publicly accessible, sensitive data contained within the activity log files can be accessed by anyone, thus increasing the risk of data breaches and unauthorized access.
|
|
remediation: |
|
|
Ensure that the Azure storage containers storing activity log files are configured to deny public access. Review and modify the public access settings of your storage accounts to protect sensitive data.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview
|
|
tags: cloud,devops,azure,microsoft,storage,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let subName of iterate(template.subscriptionNames)) {
|
|
set("subName", subName);
|
|
code(2);
|
|
for (let containerDetails of iterate(template.containerDetails)) {
|
|
set("containerDetails", containerDetails);
|
|
code(3);
|
|
}
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az monitor diagnostic-settings subscription list --query 'value[*].name'
|
|
|
|
extractors:
|
|
- type: json
|
|
name: subscriptionNames
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az monitor diagnostic-settings subscription show --name "$subName" --query 'storageAccountId'
|
|
|
|
extractors:
|
|
- type: json
|
|
name: containerDetails
|
|
internal: true
|
|
json:
|
|
- '.'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az storage container show --account-name $containerDetails --name insights-operational-logs --query 'properties.publicAccess'
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- 'container'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- 'subName + " storage container insights-operational-logs is publicly accessible"'
|
|
# digest: 4b0a00483046022100d7bd56219da046085b76932072b20700030f5a3ea8d6048e8983cf928b81c970022100b4553338405cc1b91ce0e283b8986c08c08c94790f2b34d0832366cc01aaddc0:922c64590222798bb761d5b6d8e72950 |