Back to Checks
azure

Storage account storing activity logs does not allow public blob access

monitor_storage_account_with_activity_logs_is_private
Service: monitorSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedlogging
Resource Type:microsoft.storage/storageaccounts

Azure Monitor Activity Logs sent to a Storage account are evaluated for Blob public access. The finding identifies whether the account that stores the logs has AllowBlobPublicAccess turned on.

Prowler logoProwlerprowler-provider-azure

Risk

Exposed log data undermines confidentiality by revealing operations, resource IDs, IPs, and identities.

Adversaries gain reconnaissance to map controls, craft targeted attacks, and time actions to avoid detection, enabling lateral movement and broader compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks monitor_storage_account_with_activity_logs_is_private

Recommendation

Set AllowBlobPublicAccess=false on the storage account holding logs. Enforce least privilege via RBAC or scoped SAS, use private endpoints and network restrictions, and enable immutability for log containers to add defense in depth and prevent unauthorized access.

Remediation

CLI

az storage account update --name <STORAGE_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP_NAME> --allow-blob-public-access false

Terraform

# Disable public blob access on the storage account
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<example_resource_name>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  allow_blob_public_access = false # Critical: disables public access at the account level
}

NativeIaC

// Set storage account to disallow public blob access
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  sku: { name: 'Standard_LRS' }
  kind: 'StorageV2'
  properties: {
    allowBlobPublicAccess: false // Critical: disables public access at the account level
  }
}

Other

1In Azure Portal, go to the storage account used by the diagnostic/Activity Log export
2Under Settings, select Configuration
3Set "Allow Blob public access" to Disabled
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.monitor.monitor_client import monitor_client
from prowler.providers.azure.services.storage.storage_client import storage_client


class monitor_storage_account_with_activity_logs_is_private(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            diagnostic_settings,
        ) in monitor_client.diagnostics_settings.items():
            subscription_name = monitor_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for diagnostic_setting in diagnostic_settings:
                for storage_account in storage_client.storage_accounts[subscription_id]:
                    if storage_account.name == diagnostic_setting.storage_account_name:
                        report = Check_Report_Azure(
                            metadata=self.metadata(), resource=storage_account
                        )
                        report.subscription = subscription_id
                        if storage_account.allow_blob_public_access:
                            report.status = "FAIL"
                            report.status_extended = f"Blob public access enabled in storage account {storage_account.name} storing activity logs in subscription {subscription_name} ({subscription_id})."
                        else:
                            report.status = "PASS"
                            report.status_extended = f"Blob public access disabled in storage account {storage_account.name} storing activity logs in subscription {subscription_name} ({subscription_id})."

                        findings.append(report)

        return findings

References