By default, Azure storage accounts created by Ansible accept connections from clients on any network.

Loose access configurations unnecessarily expose systems and broaden an organization's attack surface. Services open to interaction with the public are subjected to almost continuous scanning and probing by malicious entities.

Example 1: The following example Ansible task fails to restrict network access to an Azure storage account.

- name: storage with network acl
    azure_rm_storageaccount:
      resource_group: testGroup
      name: sa001
      type: Standard_RAGRS
      network_acls:
        bypass: AzureServices,Metrics
        default_action: Deny
        ip_rules:
          - value: 0.0.0.0/0
            action: Allow

Service Providers that use the UsernameToken might accept passwords sent in plain text. Sending plain text passwords over an unencrypted channel can expose the credential to attackers who can sniff the SOAP message.

Example 1: The following Axis service provider configuration uses the UsernameToken:

<deployment xmlns="http://xml.apache.org/axis/wsdd/" xmlns:java="http://xml.apache.org/axis/wsdd/providers/java">
...
	<parameter name="action" value="UsernameToken"/>
...
</deployment>

Sending plain text passwords or password hashes over an unencrypted channel can expose the credential to attackers who can sniff the SOAP message.

Example 1: The following Axis client configuration uses the UsernameToken:

<deployment xmlns="http://xml.apache.org/axis/wsdd/" xmlns:java="http://xml.apache.org/axis/wsdd/providers/java">
...
	<parameter name="action" value="UsernameToken"/>
...
</deployment>

Authentication is an essential aspect of security. The authentication process's reliability depends on the login credentials' safety and strength. Password policies ensuring users create strong passwords are crucial to deploying secure websites. Password strength is a measure of the effectiveness it provides in resisting guessing and brute force attacks. Some parameters that help define password strength include password characteristics such as password length, complexity, and randomness.

Authentication is an essential aspect of security. The authentication process's reliability depends on the login credentials' safety and strength. Password policies ensuring users create strong passwords are crucial to deploying secure websites. Password strength is a measure of the effectiveness it provides in resisting guessing and brute force attacks. Some parameters that help define password strength include password characteristics such as password length, complexity, and randomness.

AWS API Gateway methods that are publicly accessible can expose the organization to attack.

Example 1: The following example template defines publicly accessible AWS API Gateway methods.

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Resources": {
        "MyMethod0": {
            "Type": "AWS::ApiGateway::Method",
            "Properties": {
                "RestApiId": "MyAPIID",
                "ResourceId": "MyResourceID",
                "HttpMethod": "GET",
                "AuthorizationType": "NONE"
            }
        },
        "MyMethod1": {
            "Type": "AWS::ApiGateway::Method",
            "Properties": {
                "RestApiId": "MyAPIID",
                "ResourceId": "MyResourceID",
                "HttpMethod": "POST",
                "AuthorizationType": "NONE",
                "ApiKeyRequired": false
            }
        }
    }
}

Cross-Origin Resource Sharing, commonly referred to as CORS, is a technology that allows a domain to define a policy for its resources to be accessed by a web page hosted on a different domain. Historically, web browsers have restricted their domain resources from being accessed by scripts loaded from a different domain to abide by the same origin policy.
CORS provides a method for a domain to allow other domains and enable them to access its resources.

Be careful when defining a CORS policy because an overly permissive policy configured at the server level for a domain or a directory on a domain can expose more content for cross domain access than intended. CORS can enable a malicious application to communicate with a victim application inappropriately, which can lead to information disclosure, spoofing, data theft, relay, or other attacks.

Implementing CORS can increase an application's attack surface and should only be used when necessary.

Example 1: The following example template defines an overly permissive CORS policy for an Azure SignalR web application.

resource example 'Microsoft.SignalRService/SignalR@2022-02-01' = {
    ...
    properties: {
        ...
        cors: {
            ...
            allowedOrigins: [ '*' ]
        }
    }
}

Example 2: The following example template defines an overly permissive CORS policy for an Azure web application.

resource example 'Microsoft.Web/sites@2020-12-01' = {
    ...
    properties: {
        ...
        siteConfig: {
            ...
            cors: {
                ...
                allowedOrigins: [ '*' ]
            }
        }
    }
}

Example 3: The following example template defines an overly permissive CORS policy for an Azure Maps account.

resource example 'Microsoft.Maps/accounts@2021-12-01-preview' = {
    ...
    properties: {
        ...
        cors: {
            corsRules: [
                {
                    allowedOrigins: [ '*' ]
                }
            ]
        }
    }
}

Example 4: The following example template defines an overly permissive CORS policy for an Azure Cosmos DB account.

resource example 'Microsoft.DocumentDB/databaseAccounts@2023-04-15' = {
    ...
    properties: {
        ...
        cors: [
            {
                ...
                allowedOrigins: '*'
            }
        ]
    }
}

Example 5: The following example template defines an overly permissive CORS policy for an Azure storage blob service.

resource example 'Microsoft.Storage/storageAccounts/blobServices@2021-09-01' = {
    ...
    properties: {
        ...
        cors: {
            corsRules: [
                {
                    ...
                    allowedOrigins: [ '*' ]
                }
            ]
        }
    }
}

Unencrypted communication channels are prone to eavesdropping and tampering.

By default, ElastiCache replication group transport encryption is disabled. This exposes the data to unauthorized access, potential theft, and tampering.

Example 1: The following example template defines an ElastiCache replication group without transport encryption enabled.

{
    "Resources": {
        "ReplicationGroup": {
            "Properties": {
            "Engine": "redis",
            "EngineVersion": "EngineVersion",
            "ReplicasPerNodeGroup": "NumReplicas",
            "PreferredMaintenanceWindow": "sat:07:00-sat:08:00",
            "AtRestEncryptionEnabled": true,
            "CacheParameterGroupName": "CacheParameterGroup",
            "SecurityGroupIds": [
                "SecurityGroup"
            ],
            "SnapshotRetentionLimit": "SnapshotRetentionLimit",
            "CacheNodeType": "CacheNodeType",
            "CacheSubnetGroupName": "CacheSubnetGroupName",
            "NumNodeGroups": "NumShards",
            "SnapshotWindow": "00:00-03:00",
            "ReplicationGroupDescription": "AWS::StackName"
            },
            "UpdatePolicy": {
            "UseOnlineResharding": true
            },
            "DeletionPolicy": "Snapshot",
            "UpdateReplacePolicy": "Snapshot",
            "Type": "AWS::ElastiCache::ReplicationGroup"
        }
    }
}

Automatic software upgrades, which ensure timely patching of known software vulnerabilities, are disabled.

Automatic software upgrades, which ensure timely patching of known software vulnerabilities, are disabled.

Automatic software upgrades, which ensure timely patching of known software vulnerabilities, are disabled.

Automatic software upgrades, which ensure timely patching of known software vulnerabilities, are disabled.

Automatic software upgrades, which ensure timely patching of known software vulnerabilities, are disabled.

Automatic software upgrades, which ensure timely patching of known software vulnerabilities, are disabled.

Automatic software upgrades, which ensure timely patching of known software vulnerabilities, are disabled.

Automatic software upgrades, which ensure timely patching of known software vulnerabilities, are disabled.

Automatic software upgrades, which ensure timely patching of known software vulnerabilities, are disabled.

Automatic software upgrades, which ensure timely patching of known software vulnerabilities, are disabled.

Automatic software upgrades, which ensure timely patching of known software vulnerabilities, are disabled.

Insufficiently protected data communication channels can put critical organizational data at risk of theft, tampering, or disclosure.