The default network access rule for Storage Accounts should be set to deny

azure.storage
이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

Configure storage accounts to deny access to traffic from all networks (including internet traffic). Grant access to traffic from specific Azure Virtual networks, allowing a secure network boundary for specific applications to be built. Access can also be granted to public internet IP address ranges, to enable connections from specific internet or on-premises clients. When network rules are configured, only applications from allowed networks can access a storage account. When calling from an allowed network, applications continue to require proper authorization (a valid access key or SAS token) to access the storage account.

Remediation

From the console

  1. Go to Storage Accounts.
  2. For each storage account, click on the Networking blade.
  3. Click the Firewalls and virtual networks heading.
  4. Ensure that you have elected to allow access from Selected networks.
  5. Add rules to allow traffic from specific networks and click Save to apply your changes.