Ensure CORS rules are set according to organization's policy for Azure Storage Account

MEDIUM

Description

CORS is a feature for HTTP communication that manages how a web page calls an API under a different domain. This feature is important to configure properly since web browsers now have restrictions for same-origin policies. For more information, see the Azure documentation.
References:
https://learn.microsoft.com/en-us/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services
https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

Remediation

In Azure Console -

  1. Open the Azure Portal and go to Storage Accounts.
  2. Select the Storage Account that you wish to edit.
  3. Under Settings, select Resource Sharing (CORS).
  4. Under Blob Service, add CORS rules as needed.

In Terraform -

  1. In the azurerm_storage_account resource, create a blob_properties block.
  2. Create a cors_rule block inside blob_properties and configure as needed.

References:
https://learn.microsoft.com/en-us/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#cors_rule

Policy Details

Rule Reference ID: AC_AZURE_0368
CSP: Azure
Remediation Available: No
Resource Category: Storage
Resource Type: Storage Accounts

Frameworks