Azure Compliance ControlsAzure Storage
Storage accounts should have network access restrictions configured
Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. Access can be granted to specific Azure virtual networks or to public internet IP address ranges.
What this control checks
Storage account default_action for network rules must be Deny.
Framework mappings
The clauses this control is mapped to in each framework.
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 12 Asset management
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.1.12: Monitor and control remote access sessions.
- 3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- 3.1.14 Route remote access via managed access control points
4 more clauses
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 2.2.1.2 Ensure Network Access Rules are set to Deny-by-default
- 10.3.2.3 Ensure default network access rule for storage accounts is set to deny
- 9.3.2.3 Ensure default network access rule for storage accounts is set to deny
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- Annex I (5.1)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 3.6 Ensure default network access rule for Storage Accounts is set to deny
- 3.6 Ensure default network access rule for Storage Accounts is set to deny
- 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- 4.7 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- AC.L2-3.1.12 Monitor and control remote access sessions
- AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- AC.L2-3.1.14 Route remote access via managed access control points
4 more clauses
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
- AC-4 Information Flow Enforcement
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- SC-7 Boundary Protection
- SC-7(3) Access Points
- 0866.09m3Organizational.1516-09.m 09.06 Network Security Management
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions
- 164.312(a)(1) Access control
- 1.3.2 Limit inbound Internet traffic to IP addresses within the DMZ
- Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet
Related controls
- Storage accounts should have secure transfer enabled
- Storage accounts should have soft delete enabled
- MariaDB servers should have public network access disabled
- Azure Cognitive Search services should have public network access disabled
- PostgreSQL servers should have 'Allow access to Azure services' disabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_default_network_access_rule_denied - Checkov Check:
CKV_AZURE_35 - Powerpipe Controls:
azure_compliance.control.storage_account_default_network_access_deny,azure_compliance.control.storage_account_default_network_access_rule_denied,azure_compliance.control.storage_account_restrict_network_access,azure_compliance.control.storage_account_use_virtual_service_endpoint - Prowler Check:
storage_default_network_access_rule_is_denied - Azure Policy Definition:
34c877ad-507e-4c82-993e-3452a6e0ad3c - KICS Query:
a5613650-32ec-4975-a305-31af783153ea - Trivy Check:
AZU-0012
Last reviewed: 2026-10-15