View JSON (5632 bytes)
{
"policy_path": "/home/runner/work/ccc-cfi-compliance/ccc-cfi-compliance/testing/policy/CCC.Core/CCC.Core.CN05/AR01/object-storage-block-public-write-access/azure.yaml",
"name": "Azure Storage Block Blob Public Access",
"service_type": "object-storage",
"requirement_text": "When an attempt is made to modify data on the service or a child resource, the service MUST block requests from unauthorized entities. Disabling blob public access ensures the storage account is not world-writable.\n",
"validity_score": 8,
"validity_commentary": "This query validates that Azure Storage has blob public access disabled. When allowBlobPublicAccess is false, anonymous access to blobs is not permitted, reducing the risk of unauthorized data modification. Strengths: - Storage account-level setting applies to all containers - Overrides any public access settings on individual containers - Aligns with CIS and Prowler benchmarks Limitations: - Does not validate shared key or SAS token restrictions - Behavioral testing (CN05-AR01) verifies unauthorized modification is blocked at runtime - Network rules (e.g. allow from VNet only) are checked separately\n",
"query_template": "az storage account show \\\n --name ${AzureStorageAccount} \\\n --resource-group ${AzureResourceGroup} \\\n --output json\n",
"query_executed": "az storage account show \\\n --name stgcfi20260410t090725z \\\n --resource-group cfi_test_20260410t090725z \\\n --output json\n",
"query_output": "{\n \"accessTier\": \"Hot\",\n \"accountMigrationInProgress\": null,\n \"allowBlobPublicAccess\": false,\n \"allowCrossTenantReplication\": false,\n \"allowSharedKeyAccess\": true,\n \"allowedCopyScope\": null,\n \"azureFilesIdentityBasedAuthentication\": null,\n \"blobRestoreStatus\": null,\n \"creationTime\": \"2026-04-10T09:08:26.607882+00:00\",\n \"customDomain\": null,\n \"defaultToOAuthAuthentication\": false,\n \"dnsEndpointType\": \"Standard\",\n \"dualStackEndpointPreference\": null,\n \"enableExtendedGroups\": null,\n \"enableHttpsTrafficOnly\": true,\n \"enableNfsV3\": false,\n \"encryption\": {\n \"encryptionIdentity\": null,\n \"keySource\": \"Microsoft.Storage\",\n \"keyVaultProperties\": null,\n \"requireInfrastructureEncryption\": null,\n \"services\": {\n \"blob\": {\n \"enabled\": true,\n \"keyType\": \"Account\",\n \"lastEnabledTime\": \"2026-04-10T09:08:27.063268+00:00\"\n },\n \"file\": {\n \"enabled\": true,\n \"keyType\": \"Account\",\n \"lastEnabledTime\": \"2026-04-10T09:08:27.063268+00:00\"\n },\n \"queue\": null,\n \"table\": null\n }\n },\n \"extendedLocation\": null,\n \"failoverInProgress\": null,\n \"geoPriorityReplicationStatus\": null,\n \"geoReplicationStats\": null,\n \"id\": \"/subscriptions/c1cedd8e-bf91-4d7d-a4cc-45700402a2a1/resourceGroups/cfi_test_20260410t090725z/providers/Microsoft.Storage/storageAccounts/stgcfi20260410t090725z\",\n \"identity\": {\n \"principalId\": null,\n \"tenantId\": null,\n \"type\": \"None\",\n \"userAssignedIdentities\": null\n },\n \"immutableStorageWithVersioning\": null,\n \"isHnsEnabled\": false,\n \"isLocalUserEnabled\": false,\n \"isSftpEnabled\": false,\n \"isSkuConversionBlocked\": null,\n \"keyCreationTime\": {\n \"key1\": \"2026-04-10T09:08:27.057745+00:00\",\n \"key2\": \"2026-04-10T09:08:27.057745+00:00\"\n },\n \"keyPolicy\": null,\n \"kind\": \"StorageV2\",\n \"largeFileSharesState\": null,\n \"lastGeoFailoverTime\": null,\n \"location\": \"eastus\",\n \"minimumTlsVersion\": \"TLS1_2\",\n \"name\": \"stgcfi20260410t090725z\",\n \"networkRuleSet\": {\n \"bypass\": \"AzureServices\",\n \"defaultAction\": \"Allow\",\n \"ipRules\": [],\n \"ipv6Rules\": [],\n \"resourceAccessRules\": [],\n \"virtualNetworkRules\": []\n },\n \"placement\": null,\n \"primaryEndpoints\": {\n \"blob\": \"https://stgcfi20260410t090725z.blob.core.windows.net/\",\n \"dfs\": \"https://stgcfi20260410t090725z.dfs.core.windows.net/\",\n \"file\": \"https://stgcfi20260410t090725z.file.core.windows.net/\",\n \"internetEndpoints\": null,\n \"ipv6Endpoints\": null,\n \"microsoftEndpoints\": null,\n \"queue\": \"https://stgcfi20260410t090725z.queue.core.windows.net/\",\n \"table\": \"https://stgcfi20260410t090725z.table.core.windows.net/\",\n \"web\": \"https://stgcfi20260410t090725z.z13.web.core.windows.net/\"\n },\n \"primaryLocation\": \"eastus\",\n \"privateEndpointConnections\": [],\n \"provisioningState\": \"Succeeded\",\n \"publicNetworkAccess\": \"Enabled\",\n \"resourceGroup\": \"cfi_test_20260410t090725z\",\n \"routingPreference\": null,\n \"sasPolicy\": null,\n \"secondaryEndpoints\": null,\n \"secondaryLocation\": \"westus\",\n \"sku\": {\n \"name\": \"Standard_GRS\",\n \"tier\": \"Standard\"\n },\n \"statusOfPrimary\": \"available\",\n \"statusOfSecondary\": \"available\",\n \"storageAccountSkuConversionStatus\": null,\n \"tags\": {},\n \"type\": \"Microsoft.Storage/storageAccounts\",\n \"zones\": null\n}\n",
"passed": true,
"rule_results": [
{
"jsonpath": "$.allowBlobPublicAccess",
"expected_values": [
"false"
],
"validation_rule": "^false$",
"description": "Validates that blob public access is disabled at the storage account level. When false, anonymous access is not permitted regardless of container ACLs. This is a necessary precondition for blocking unauthorized data modification.\n",
"actual_value": "[false]",
"passed": true
}
]
}