Storage accounts should have network access restrictions configured
Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. Access can be granted to specific Azure virtual networks or to public internet IP address ranges.
With the default action set to Allow, the public endpoint is reachable from any network. This removes a network boundary, so stolen access keys or leaked SAS tokens can be abused from anywhere, enabling data exfiltration, tampering, and destructive writes.
What this control checks
Storage account default_action for network rules must be Deny.
Common pitfalls
Check is skipped when separate network rules resource is used
Network Rules can be defined either directly on the azurerm_storage_account resource, or using the azurerm_storage_account_network_rules resource. If the latter is used, the check is skipped for the azurerm_storage_account resource.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Storage accounts should restrict network access" (34c877ad-507e-4c82-993e-3452a6e0ad3c); Prowler check storage_default_network_access_rule_is_denied (prowler azure --checks storage_default_network_access_rule_is_denied); PowerPipe controls azure_compliance.control.storage_account_default_network_access_deny, azure_compliance.control.storage_account_default_network_access_rule_denied, azure_compliance.control.storage_account_restrict_network_access and 1 more.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 1.2.1 (As part of their policy on the security of network and information systems referred to in point 1.1., the relevant...), 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...), 11.2.1 (The relevant entities shall provide, modify, remove and document access rights to network and information systems in...) and 3 more clauses.
NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control), AC-4 (Information Flow Enforcement) and 2 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access), AC-17(1) (Automated Monitoring/Control), AC-4 (Information Flow Enforcement) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 12 Asset management
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.1.12: Monitor and control remote access sessions.
- 3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- 3.1.14 Route remote access via managed access control points
4 more clauses
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 2.2.1.2 Ensure Network Access Rules are set to Deny-by-default
- 10.3.2.3 Ensure default network access rule for storage accounts is set to deny
- 9.3.2.3 Ensure default network access rule for storage accounts is set to deny
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- Annex I (5.1)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 3.6 Ensure default network access rule for Storage Accounts is set to deny
- 3.6 Ensure default network access rule for Storage Accounts is set to deny
- 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- 4.7 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- AC.L2-3.1.12 Monitor and control remote access sessions
- AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- AC.L2-3.1.14 Route remote access via managed access control points
4 more clauses
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
- AC-4 Information Flow Enforcement
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- SC-7 Boundary Protection
- SC-7(3) Access Points
- 0866.09m3Organizational.1516-09.m 09.06 Network Security Management
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions
- 164.312(a)(1) Access control
- 1.3.2 Limit inbound Internet traffic to IP addresses within the DMZ
- Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet
Related controls
- Storage accounts should have secure transfer enabled
- Storage accounts should have soft delete enabled
- MariaDB servers should have public network access disabled
- Azure Cognitive Search services should have public network access disabled
- PostgreSQL servers should have 'Allow access to Azure services' disabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_default_network_access_rule_denied - Checkov Check:
CKV_AZURE_35 - Powerpipe Controls:
azure_compliance.control.storage_account_default_network_access_deny,azure_compliance.control.storage_account_default_network_access_rule_denied,azure_compliance.control.storage_account_restrict_network_access,azure_compliance.control.storage_account_use_virtual_service_endpoint - Prowler Check:
storage_default_network_access_rule_is_denied - Azure Policy Definition:
34c877ad-507e-4c82-993e-3452a6e0ad3c - KICS Query:
a5613650-32ec-4975-a305-31af783153ea - Trivy Check:
AZU-0012
Last reviewed: 2026-10-15