azure-security-baseline

Standard IDs

ID	Benchmark control	Severity
ASB-NS-1	Network Security NS-1: no public access to storage	P0
ASB-NS-2	Network Security NS-2: use private endpoints for PaaS	P1
ASB-IM-1	Identity Management IM-1: managed identity over keys	P0
ASB-IM-2	Identity Management IM-2: Key Vault for secrets, not inline	P0
ASB-PA-1	Privileged Access PA-1: no Owner/Contributor at subscription	P1
ASB-LT-1	Logging & Threat LT-1: Defender plan enabled	P2

---

Check A — Public storage access (ASB-NS-1)

P0: exploitable now — unauthenticated data read.

// BAD: allowBlobPublicAccess enables anonymous blob read
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  properties: {
    allowBlobPublicAccess: true   // ASB-NS-1: P0
  }
}

// BAD: container-level public access
resource container 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-01-01' = {
  properties: {
    publicAccess: 'Blob'          // ASB-NS-1: P0
    // or publicAccess: 'Container'
  }
}

// GOOD
properties: {
  allowBlobPublicAccess: false
  publicNetworkAccess: 'Disabled'
}

Detection rule: scan .bicep files for allowBlobPublicAccess: true or publicAccess: 'Blob' or publicAccess: 'Container'.

---

Check B — Private endpoints for PaaS (ASB-NS-2)

Flag SQL Server, Storage, Key Vault, Service Bus, and Container Registry resources that have publicNetworkAccess: 'Enabled' without a corresponding privateEndpoints resource.

// BAD: SQL Server open to public network
resource sql 'Microsoft.Sql/servers@2023-02-01-preview' = {
  properties: {
    publicNetworkAccess: 'Enabled'   // ASB-NS-2: P1
  }
}

// GOOD: public access disabled, private endpoint defined elsewhere
properties: {
  publicNetworkAccess: 'Disabled'
}

---

Check C — Managed identity over connection-string keys (ASB-IM-1)

P0: key rotation failure = immediate credential exposure.

Scan .bicep files for:

• listKeys( function calls assigned to outputs or stored as secrets
• storageAccountKey / primaryKey / secondaryKey references in connection-string outputs