Azure Compliance ControlsAzure Storage
Storage accounts should have the default network access rule set to deny
Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. The default network access rule should be set to Deny.
What this control checks
Checks the default network access rule setting on each storage account
Framework mappings
The clauses this control is mapped to in each framework.
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 12 Asset management
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 2.2.1.2 Ensure Network Access Rules are set to Deny-by-default
- 10.3.2.3 Ensure default network access rule for storage accounts is set to deny
- 9.3.2.3 Ensure default network access rule for storage accounts is set to deny
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- Annex I (5.1)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- 4.7 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- AC.L2-3.1.12 Monitor and control remote access sessions
- AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- AC.L2-3.1.14 Route remote access via managed access control points
4 more clauses
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(1) Access control
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_default_network_access_deny - Checkov Check:
CKV_AZURE_35 - Powerpipe Controls:
azure_compliance.control.storage_account_default_network_access_deny,azure_compliance.control.storage_account_default_network_access_rule_denied - Prowler Check:
storage_default_network_access_rule_is_denied - Azure Policy Definition:
34c877ad-507e-4c82-993e-3452a6e0ad3c - KICS Query:
a5613650-32ec-4975-a305-31af783153ea - Trivy Check:
AZU-0012
Last reviewed: 2026-10-15