Storage accounts should have the default network access rule set to deny
Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. The default network access rule should be set to Deny.
With the default action set to Allow, the public endpoint is reachable from any network. This removes a network boundary, so stolen access keys or leaked SAS tokens can be abused from anywhere, enabling data exfiltration, tampering, and destructive writes.
What this control checks
Checks the default network access rule setting on each storage account
Common pitfalls
Network rules can be defined in two places
Network Rules can be defined either directly on the azurerm_storage_account resource, or using the azurerm_storage_account_network_rules resource. If the latter is used, the check is skipped for the azurerm_storage_account resource.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Storage accounts should restrict network access" (34c877ad-507e-4c82-993e-3452a6e0ad3c); Prowler check storage_default_network_access_rule_is_denied (prowler azure --checks storage_default_network_access_rule_is_denied); PowerPipe controls azure_compliance.control.storage_account_default_network_access_deny and azure_compliance.control.storage_account_default_network_access_rule_denied.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_35; KICS query "Default Azure Storage Account Network Access Is Too Permissive" (a5613650-32ec-4975-a305-31af783153ea); Trivy check AZU-0012.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 1.2.1 (As part of their policy on the security of network and information systems referred to in point 1.1., the relevant...), 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...), 11.2.1 (The relevant entities shall provide, modify, remove and document access rights to network and information systems in...) and 3 more clauses.
FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access), AC-17(1) (Automated Monitoring/Control), AC-4 (Information Flow Enforcement) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 12 Asset management
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 2.2.1.2 Ensure Network Access Rules are set to Deny-by-default
- 10.3.2.3 Ensure default network access rule for storage accounts is set to deny
- 9.3.2.3 Ensure default network access rule for storage accounts is set to deny
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- Annex I (5.1)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- 4.7 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- AC.L2-3.1.12 Monitor and control remote access sessions
- AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- AC.L2-3.1.14 Route remote access via managed access control points
4 more clauses
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(1) Access control
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_default_network_access_deny - Checkov Check:
CKV_AZURE_35 - Powerpipe Controls:
azure_compliance.control.storage_account_default_network_access_deny,azure_compliance.control.storage_account_default_network_access_rule_denied - Prowler Check:
storage_default_network_access_rule_is_denied - Azure Policy Definition:
34c877ad-507e-4c82-993e-3452a6e0ad3c - KICS Query:
a5613650-32ec-4975-a305-31af783153ea - Trivy Check:
AZU-0012
Last reviewed: 2026-10-15