Storage account must disable anonymous blob public access

Critical Azure General storage-storage-account-disable-anonymous

Applies to

Microsoft.Storage/storageAccounts

What CGPulse checks

A resource passes this rule when allowBlobPublicAccess must equal false. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Disable anonymous public blob access to prevent sensitive data exposure. In Azure Portal: Storage account > Configuration > set Allow Blob anonymous access to Disabled. See: https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent

Careful: Disabling anonymous blob access breaks public-facing apps serving blobs with 'blob' or 'container' access level

CLI

az storage account update --ids "{id}" --allow-blob-public-access false

Terraform

resource "azurerm_storage_account" "{name}" {
  name                             = "{name}"
  resource_group_name              = "{rg}"
  location                         = var.location
  account_tier                     = "Standard"
  account_replication_type         = "LRS"
  allow_nested_items_to_be_public  = false
}

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan