Publicly accessible Azure Storage blob container is a crown jewel

azure.storage

Description

An Azure Storage blob container that holds crown-jewel data is publicly accessible. Crown-jewel resources contain your organization’s most sensitive or business-critical data, and a public-access configuration on the container or its parent storage account allows that data to be read without authentication from any network location.

An attacker can enumerate and exfiltrate blobs directly after discovering the container endpoint, without first compromising an identity or pivoting through the network. The combination of public exposure and crown-jewel classification makes this a high-value, low-effort target and a direct path to data compromise.

Remediation

  1. Set the container’s anonymous access level to Private (no anonymous access). See Configure anonymous read access for containers and blobs.
  2. Disallow anonymous access on the parent storage account so that no container in the account can accept anonymous requests. See Remediate anonymous read access to blob data.