3

Azure's resources are generally made publicly accessible when launched (from a network point-of-view). e.g. An Azure SQL database will be given a public DNS name and the port will be accessible from the Internet, albeit a password will be required. The same premise holds for App Services, Keys etc.

I want to know the public profile of my Azure environment, i.e. all the end-points that are facing the Internet. Is there a mechanism to do this, either in Azure or with a script?

1

Yes

You must do the following to get a network map view of the environment.

  1. Setup a 'log analytics workspace'
  2. In 'Storage Accounts Blade' goto diagnostic settings and point the diagnostic logs to the new 'log analytics workstpace'
  3. Upgrade your ASC 'Azure Security Center' subscription to Standard.

    • Select the new log analytics workspace you configured as the logging solution.
  4. Agent Automatic Install - in ASC, enable the default ASC Policy, this will force installation of agents to any VM's you have.

  5. Wait an hour

    • After an hour or so your log analytics workspace will have some logs in it and have a map of your environment.
  6. Goto Azure Security Center > Resource Security Hygiene > Networking. Under Network Map click 'See Topology'

You will get something like this.

enter image description here

  1. Azure SQL Remediation. If you want to remediate the pub IP in your SQL instance, do the following.

Configure Virtual Switch - you will want to configure a virtual switch with a /16 subnet network address. Once provisioned, add a /24 subnet under the 'subnets' blade. Your adding the /16 so you can provision multiple subnets within your switch. There are multiple ways to do this, I'm simply suggesting one method to quickly remediate your SQL public access. You can always implement something with better networking efficacy later.

  1. Advertise your SQL. Add the SQL to the private network space of one of the subnets your configured to your private virtual switch earlier.

  2. Add a Firewall. Add a firewall to the switch and configure a public IP to the front of it. You can now add your standard ruleset to the pub IP. Don't forget the last rule, DENY ALL.

That's the basics.

The network map will give you insight to ALL your public resources, the switch and FW will secure your SQL instance.

*remember, every 'storage account' is public and http by default. Goto the firewall blade within each storage account and select the radio button 'force https' AND create a rule that the storage account is available only to your virtual networks. If you require access from a public IP with a local instance of 'Storage Explorer' you can add your public IP to the ruleset in that blade by simply clicking 'add'. That will secure your storage accounts from public access, except from your Pub IP. Cheers, hope this is helpful.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.