AZ_HAS_CONTAINER

Summary

Forestall ACL Alias	AZ_HAS_CONTAINER
Azure Alias	Storage Account contains Blob Container
Affected Object Types	Storage Account -> Blob Container
Edge Direction	AZStorageAccount -> AZStorageContainer
Exploitation Certainty	Informational

Description

AZ_HAS_CONTAINER is the containment edge from an Azure Storage Account (AZStorageAccount) to a blob container (AZStorageContainer) it holds. It represents that the storage account contains the container, with the edge pointing from the account to the container.

The container node carries properties such as PublicAccess (None / Blob / Container), LeaseStatus, LeaseState, HasImmutabilityPolicy, HasLegalHold, and DefaultEncryptionScope.

Identification

PowerShell (Az Module)

Connect-AzAccount

$account = Get-AzStorageAccount -ResourceGroupName "<RG>" -Name "<StorageAccountName>"
$ctx = $account.Context

# List the containers held by the storage account
Get-AzStorageContainer -Context $ctx |
    Select-Object Name, @{N='PublicAccess';E={$_.PublicAccess}}, LastModified |
    Format-Table -AutoSize

Azure Portal

1. Open Azure Portal -> Storage accounts -> select the account.

2. Go to Data storage -> Containers to see every container the account holds and its public access level.

Exploitation

There is no direct exploit for this edge; it represents containment. The relevant abuse happens against the container's data plane or its RBAC scope. See AZ_STORAGE_BLOB_DATA_READER, AZ_STORAGE_BLOB_DATA_WRITER, AZ_STORAGE_LIST_KEYS, and AZ_STORAGE_SAS_GENERATE. A container whose PublicAccess is Blob or Container can be read anonymously and should be treated as exposed.

Mitigation

• Set container public access level to None unless anonymous read is explicitly required, and disable AllowBlobPublicAccess at the account level.

• Apply RBAC at the narrowest scope; avoid granting data-plane roles at account scope when container scope suffices.

• Enable soft delete, versioning, and immutability policies for sensitive containers.

Detection

Use the Azure Portal:

1. Open Azure Portal -> Monitor -> Activity log and filter for Microsoft.Storage/storageAccounts/blobServices/containers/write and public-access changes.

2. Review the storage account's Containers blade for any container with Blob or Container public access.

3. Review Access control (IAM) at account and container scope for unexpected data-plane role assignments.

References

• https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction

• https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-configure

• https://learn.microsoft.com/en-us/azure/role-based-access-control/scope-overview