Add rule AZ‑STOR‑007 — Storage Account Missing Private Endpoint

[Ablaze005]

Rule Details

• Rule ID: AZ-STOR-007
• Severity: HIGH
• Category: Storage
• Frameworks: CIS / NIST / ISO 27001 / SOC 2

What does it detect?

  This rule detects Azure Storage Accounts that do not have any Private Endpoint connections configured.
  A Storage Account without a Private Endpoint remains reachable over the public internet, increasing exposure to unauthorized access, data exfiltration, and network‑based attacks.

Detection logic

• Query Storage Accounts using:
  Microsoft.Storage/storageAccounts

-Inspect the property:
properties.privateEndpointConnections

-If:

• The list is empty, or

• The property is null, or

* No Private Endpoint connection is in an Approved state

  → return one HIGH severity finding.

• If one or more Private Endpoints exist → return no findings.

Why is this a security risk?

Storage Accounts exposed publicly can be accessed from any network on the internet.
Without Private Endpoints:

• Traffic does not stay inside the customer’s VNet

• Attack surface increases significantly

• Lateral movement becomes easier

• Compliance frameworks (CIS, NIST, ISO) are violated

• Sensitive data may be reachable from untrusted networks

Private Endpoints enforce network isolation, ensuring Storage traffic flows only through private IPs inside Azure VNets.

Remediation steps

Azure CLI

az network private-endpoint create
--name
--resource-group
--vnet-name
--subnet
--private-connection-resource-id
--group-id blob

Test plan

• Tested against real Azure free trial subscription
• Compliant case returns no findings
• Non-compliant case returns correct finding
• CLI playbook written and tested
• All four compliance framework JSONs updated