storage-exposure-auditor_skill

Overview

This skill identifies publicly accessible Azure Storage accounts and misconfigured blob containers that expose data. It analyzes exported account, container, and network rule data to produce prioritized findings and remediation templates. The goal is rapid risk identification and actionable hardening guidance without accessing your Azure tenancy directly.

How this skill works

Provide exported Azure storage account and container metadata (account-level public access, container publicAccess, network rules, private endpoints, and related settings). The skill inspects those inputs for unsafe configurations such as account-level public access, anonymous containers, disabled HTTPS, missing soft delete/versioning, permissive SAS usage, and lack of diagnostics. Results include a prioritized findings table, estimated sensitivity based on naming, hardened ARM/Bicep snippets per finding, and SAS token guidance.

When to use it

• After running read-only Azure CLI queries to export storage account and container configurations.
• During a security review or pre-deployment audit to ensure no accidental public exposure.
• When responding to a suspected data leak to quickly map public containers and their risk.
• Before enabling automated scans or Defender for Storage to prioritize high-risk assets.
• When preparing policy enforcement (Azure Policy) to deny public blob access org-wide.

Best practices

• Disable account-level allowBlobPublicAccess and only use scoped, time-limited SAS where needed.
• Require HTTPS (supportsHttpsTrafficOnly = true) and prefer private endpoints or service endpoints.
• Enable soft delete for blobs and containers and enable blob versioning for critical data.
• Rotate shared keys regularly and prefer Entra ID authentication with RBAC; disable shared key access when possible.
• Enable diagnostic logging and integrate with SIEM and Microsoft Defender for Storage for malware scanning.

Example use cases

• Audit a subscription after a developer reports a public container created for testing.
• Produce an executive summary of storage exposure across multiple resource groups.
• Generate ARM/Bicep remediation snippets to fix specific containers found with anonymous access.
• Validate that storage accounts used for backups have versioning and soft delete enabled.
• Assess SAS token usage to find long-lived or overly permissive tokens being used as permanent credentials.