Check ID: storage_ensure_private_endpoints_in_storage_accounts
Provider: Azure
Service: storage
Severity: MEDIUM
Categories: internet-exposed, trust-boundaries
Resource type: microsoft.storage/storageaccounts

​
What this check verifies

Azure Storage accounts are evaluated for the presence of Private Endpoint connections. When configured, traffic flows over a VNet private IP via Private Link; when absent, access occurs through the storage account’s public endpoint.

​
Risk

Relying on the public endpoint widens exposure:
  • Confidentiality: higher risk of key/SAS compromise and unauthorized reads
  • Integrity: abused creds enable writes/deletes
  • Availability: subject to DDoS and internet scanning It can also bypass egress controls, easing covert data exfiltration.

​
Recommendation

Prefer Private Endpoints for storage access and minimize public exposure:
  • Limit or disable Public network access
  • Use private DNS so names resolve to private IPs
  • Enforce least privilege and defense in depth with segmentation and logging
  • Monitor access and rotate keys/SAS as part of routine hygiene.

​
Remediation

# Create a Private Endpoint for a Storage Account to add a private endpoint connection (PASS)
variable "resource_group_name" { type = string }
variable "location" { type = string }
variable "subnet_id" { type = string }
variable "storage_account_id" { type = string }

resource "azurerm_private_endpoint" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = var.resource_group_name
  location            = var.location
  subnet_id           = var.subnet_id

  private_service_connection {
    name                           = "conn"
    private_connection_resource_id = var.storage_account_id  # Critical: links to the storage account
    subresource_names              = ["blob"]                # Critical: targets Blob subresource to create the connection
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = storage_ensure_private_endpoints_in_storage_accounts. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks