Publicly accessible Azure Function App has an assigned managed identity that can read data from crown jewel storage

azure

Description

A publicly accessible Azure Function App has an assigned managed identity that can read data from a crown jewel blob container. If the function app is compromised, an attacker could use the managed identity to read or exfiltrate business-critical data.

Remediation

  1. Restrict public network access to the function app by configuring inbound access restrictions or a private endpoint. See Azure Functions networking options.
  2. Remove unnecessary Blob data read permissions from the managed identity. See Remove Azure role assignments.