Identify Public Storage Account

Hi!

By default, a storage account allows public access to be configured for containers in the account, but does not enable public access to your data. Public access to blob data is never permitted unless you take the additional step to explicitly configure the public access setting for a container.

Microsoft introduced a new protection feature to help avoid public access on storage account. The feature introduces a new property named allowBlobPublicAccess.

Microsoft recommends that you disallow public access to a storage account unless your scenario requires it. Disallowing public access helps to prevent data breaches caused by undesired anonymous access.

In this article, I will you show you how you can identify these storage accounts with an Azure Graph query:

resources
| where type =~ 'Microsoft.Storage/storageAccounts'
| extend allowBlobPublicAccess = parse_json(properties).allowBlobPublicAccess
| project name, resourceGroup, allowBlobPublicAccess

Few months ago, I written an article to show you how you can identify these storage accounts with an audit Azure Policy: https://zigmax.net/identifier-les-comptes-de-stockage-publiques/ (This article is written in French).

Maxime.

Planned Maintenance Windows in AKS

Hi!

Azure Kubernetes Service (AKS) now supports planned maintenance windows. This allows you to specify planned maintenance windows so you can control when weekly releases or proactive maintenance events may be performed in your clusters and minimize interruptions during hours when you need your clusters to be available.

When using Planned Maintenance, the following restrictions apply:

  • AKS reserves the right to break these windows for unplanned/reactive maintenance operations that are urgent or critical.
  • Currently, performing maintenance operations are considered best-effort only and are not guaranteed to occur within a specified window.
  • Updates cannot be blocked for more than seven days.

Allow maintenance on every Monday at 1:00am to 2:00am

az aks maintenanceconfiguration add -g MyResourceGroup --cluster-name myAKSCluster --name default --weekday Monday --start-hour 1

Update an existing maintenance window

az aks maintenanceconfiguration update -g MyResourceGroup --cluster-name myAKSCluster --name default --weekday Monday --start-hour 1

List all maintenance windows in an existing cluster

az aks maintenanceconfiguration list -g MyResourceGroup --cluster-name myAKSCluster

Show a specific maintenance configuration window in an AKS cluster

az aks maintenanceconfiguration show -g MyResourceGroup --cluster-name myAKSCluster --name default

Delete a certain maintenance configuration window in an existing AKS Cluster

az aks maintenanceconfiguration delete -g MyResourceGroup --cluster-name myAKSCluster --name default

Maxime.

Azure Graph – List Public IPs

Hi,

In this article, I will show you how you can list all the public IPs of your Azure tenant.

Please, run the following script in Azure Resource Graph Explorer:

 Resources
 | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) 
 | project
     name,
     properties.ipAddress,
     properties.publicIPAllocationMethod 
 | limit 100

Maxime.