Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'
Anonymous public read access to containers and blobs in Azure Storage might present security risks. This control checks that `allowBlobPublicAccess` is set to `false` on storage accounts, so containers or blobs cannot be set to a public access level.
What this control checks
Azure Policy 4fa4b6c0-31ca-4c0d-b10d-24b96f62a751 applies its effect to Microsoft.Storage/storageAccounts when allowBlobPublicAccess does not equal false. Azure Policy 13502221-8df0-4414-9937-de9c5c4e396b uses the Modify effect to addOrReplace allowBlobPublicAccess with the value false. Checkov CKV_AZURE_190 inspects allow_nested_items_to_be_public on azurerm_storage_account and expects False. Checkov CKV2_AZURE_47 requires allow_nested_items_to_be_public on azurerm_storage_account to exist and to equal false. Prowler storage_blob_public_access_level_is_disabled states that setting allowBlobPublicAccess to false enforces no anonymous reads across the account.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
10 more clauses
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.2.6: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- 12 Asset management
- 10.3.9 Ensure that 'Allow Blob Anonymous Access' is set to 'Disabled'
- 9.3.8 Ensure that 'Allow Blob Anonymous Access' is set to 'Disabled'
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OPS-32.01B Guidelines and instructions with technical and organisational measures for the planning and management of containers are documented, communicated and provided in accordance with SP-01. These guidelines and instructions contain specifications for the entire container life cycle...
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 3.7 Ensure that 'Public access level' is disabled for storage accounts with blob containers
- 3.17 Ensure that `Allow Blob Anonymous Access` is set to `Disabled`
- 4.17 Ensure that `Allow Blob Anonymous Access` is set to `Disabled`
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(1) Access control
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_blob_public_access_disabled - Checkov Checks:
CKV2_AZURE_47,CKV_AZURE_190 - Powerpipe Control:
azure_compliance.control.storage_account_blob_public_access_disabled - Prowler Check:
storage_blob_public_access_level_is_disabled - Azure Policy Definitions:
13502221-8df0-4414-9937-de9c5c4e396b,4fa4b6c0-31ca-4c0d-b10d-24b96f62a751
Last reviewed: 2026-10-15