Getting Started

Checks

AWS Checks

Home AWS001 AWS002 AWS003 AWS004 AWS005 AWS006 AWS007 AWS008 AWS009 AWS010 AWS011 AWS012 AWS013 AWS014 AWS015 AWS016 AWS017 AWS018 AWS019 AWS020 AWS021 AWS022 AWS023 AWS024 AWS025 AWS031 AWS032 AWS033 AWS034 AWS035 AWS036 AWS037 AWS038 AWS039 AWS040 AWS041 AWS042 AWS043 AWS044 AWS045 AWS046 AWS047 AWS048 AWS049 AWS050 AWS051 AWS052 AWS053 AWS054 AWS055 AWS057

AZURE Checks

Home AZU001 AZU002 AZU003 AZU004 AZU005 AZU006 AZU007 AZU008 AZU009 AZU010 AZU011 AZU012 AZU013 AZU014 AZU015 AZU016 AZU017 AZU018 AZU019

GENERAL Checks

Home GEN001 GEN002 GEN003

GOOGLE Checks

Home GCP001 GCP002 GCP003 GCP004 GCP005 GCP006 GCP007 GCP008 GCP009 GCP010 GCP011 GCP012

Github Actions

Code Scanning Alerts PR Commenter

AZU013

Trusted Microsoft Services should have bypass access to Storage accounts

Explanation

Some Microsoft services that interact with storage accounts operate from networks that can’t be granted access through network rules.

To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules

Insecure Example

The following example will fail the AZU013 check.

resource "azurerm_storage_account" "bad_example" {
  name                = "storageaccountname"
  resource_group_name = azurerm_resource_group.example.name

  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"

  network_rules {
    default_action             = "Deny"
    ip_rules                   = ["100.0.0.1"]
    virtual_network_subnet_ids = [azurerm_subnet.example.id]
	bypass                     = ["Metrics"]
  }

  tags = {
    environment = "staging"
  }
}

resource "azurerm_storage_account_network_rules" "test" {
  resource_group_name  = azurerm_resource_group.test.name
  storage_account_name = azurerm_storage_account.test.name

  default_action             = "Allow"
  ip_rules                   = ["127.0.0.1"]
  virtual_network_subnet_ids = [azurerm_subnet.test.id]
  bypass                     = ["Metrics"]
}

Secure Example

The following example will pass the AZU013 check.

resource "azurerm_storage_account" "good_example" {
  name                = "storageaccountname"
  resource_group_name = azurerm_resource_group.example.name

  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"

  network_rules {
    default_action             = "Deny"
    ip_rules                   = ["100.0.0.1"]
    virtual_network_subnet_ids = [azurerm_subnet.example.id]
    bypass                     = ["Metrics", "AzureServices"]
  }

  tags = {
    environment = "staging"
  }
}

resource "azurerm_storage_account_network_rules" "test" {
  resource_group_name  = azurerm_resource_group.test.name
  storage_account_name = azurerm_storage_account.test.name

  default_action             = "Allow"
  ip_rules                   = ["127.0.0.1"]
  virtual_network_subnet_ids = [azurerm_subnet.test.id]
  bypass                     = ["Metrics", "AzureServices"]
}

Improve this page