Publicly accessible Azure Container App has an assigned managed identity that can read data from crown jewel storage

azure

Description

A publicly accessible Azure Container App has an assigned managed identity that can read data from a crown jewel blob container. If the container app is compromised, an attacker could use the managed identity to read or exfiltrate business-critical data.

Remediation

  1. Restrict public network access to the container app by using internal ingress or IP ingress restrictions. See Configure ingress for Azure Container Apps.
  2. Remove unnecessary Blob data read permissions from the managed identity. See Remove Azure role assignments.