Storage accounts must not allow public network access. Broad network access or open IP ranges expose account endpoints and data to unauthorized access and exfiltration.
For Ansible azure_rm_storageaccount and azure.azcollection.azure_rm_storageaccount tasks, ensure network_acls.default_action is not set to "Allow" (use "Deny"). When default_action is "Deny", the network_acls.ip_rules list must not contain the catch-all "0.0.0.0/0". Resources missing these properties, with default_action='Allow', or with ip_rules containing 0.0.0.0/0 are flagged.
Secure example for an Ansible task:
- name:Create storage account with restricted network accessazure.azcollection.azure_rm_storageaccount:resource_group:my-rgname:mystorageacctlocation:eastusnetwork_acls:default_action:Denyip_rules:- value:203.0.113.5/32
Compliant Code Examples
- name:configure firewall and virtual networksazure_rm_storageaccount:resource_group:myResourceGroupname:clh0002type:Standard_RAGRSnetwork_acls:bypass:AzureServices,Metricsdefault_action:Denyip_rules:- value:1.2.3.4action:Allow
Non-Compliant Code Examples
- name:configure firewall and virtual networksazure_rm_storageaccount:resource_group:myResourceGroupname:clh0002type:Standard_RAGRSnetwork_acls:bypass:AzureServices,Metricsdefault_action:Denyip_rules:- value:0.0.0.0/0action:Allow- name:configure firewall and more virtual networksazure_rm_storageaccount:resource_group:myResourceGroupname:clh0003type:Standard_RAGRSnetwork_acls:bypass:AzureServices,Metricsdefault_action:Allow
1
2
rulesets:- Ansible / Azure # Rules to enforce / Azure.
맞춤형 데모 요청
Datadog 시작하기
Ask AI
AI-generated responses may be inaccurate. Verify important info.
