CRITICAL
Source
Trivy
ID
AVD-AZU-0012

The default action on Storage account network rules should be set to deny

The default_action for network rules should come into effect when no other rules are matched. The default action should be set to Deny.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Set network rules to deny

1
2
3
4
5
6
7
8
 resource "azurerm_storage_account_network_rules" "good_example" {
   
   default_action             = "Deny"
   ip_rules                   = ["127.0.0.1"]
   virtual_network_subnet_ids = [azurerm_subnet.test.id]
   bypass                     = ["Metrics"]
 }