The default action on Storage account network rules should be set to deny
The default_action for network rules should come into effect when no other rules are matched.
The default action should be set to Deny.
Impact
Network rules that allow could cause data to be exposed publicly
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Set network rules to deny
1
2
3
4
5
6
7
8
|
resource "azurerm_storage_account_network_rules" "good_example" {
default_action = "Deny"
ip_rules = ["127.0.0.1"]
virtual_network_subnet_ids = [azurerm_subnet.test.id]
bypass = ["Metrics"]
}
|
Links