> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_has_container.md).

# AZ\_HAS\_CONTAINER

## Summary

|                            |                                         |
| -------------------------- | --------------------------------------- |
| **Forestall ACL Alias**    | AZ\_HAS\_CONTAINER                      |
| **Azure Alias**            | Storage Account contains Blob Container |
| **Affected Object Types**  | Storage Account -> Blob Container       |
| **Edge Direction**         | AZStorageAccount -> AZStorageContainer  |
| **Exploitation Certainty** | Informational                           |

## Description

`AZ_HAS_CONTAINER` is the containment edge from an **Azure Storage Account** (`AZStorageAccount`) to a **blob container** (`AZStorageContainer`) it holds. It represents that the storage account contains the container, with the edge pointing from the account to the container.

The container node carries properties such as `PublicAccess` (None / Blob / Container), `LeaseStatus`, `LeaseState`, `HasImmutabilityPolicy`, `HasLegalHold`, and `DefaultEncryptionScope`.

## Identification

### PowerShell (Az Module)

```powershell
Connect-AzAccount

$account = Get-AzStorageAccount -ResourceGroupName "<RG>" -Name "<StorageAccountName>"
$ctx = $account.Context

# List the containers held by the storage account
Get-AzStorageContainer -Context $ctx |
    Select-Object Name, @{N='PublicAccess';E={$_.PublicAccess}}, LastModified |
    Format-Table -AutoSize
```

### Azure Portal

1. Open **Azure Portal** -> **Storage accounts** -> select the account.
2. Go to **Data storage** -> **Containers** to see every container the account holds and its public access level.

## Exploitation

There is no direct exploit for this edge; it represents containment. The relevant abuse happens against the container's data plane or its RBAC scope. See [AZ\_STORAGE\_BLOB\_DATA\_READER](https://docs.forestall.io/fsprotect/edges/azure/az_storage_blob_data_reader), [AZ\_STORAGE\_BLOB\_DATA\_WRITER](https://docs.forestall.io/fsprotect/edges/azure/az_storage_blob_data_writer), [AZ\_STORAGE\_LIST\_KEYS](https://docs.forestall.io/fsprotect/edges/azure/az_storage_list_keys), and [AZ\_STORAGE\_SAS\_GENERATE](https://docs.forestall.io/fsprotect/edges/azure/az_storage_sas_generate). A container whose `PublicAccess` is Blob or Container can be read anonymously and should be treated as exposed.

## Mitigation

* Set container **public access level** to None unless anonymous read is explicitly required, and disable `AllowBlobPublicAccess` at the account level.
* Apply RBAC at the narrowest scope; avoid granting data-plane roles at account scope when container scope suffices.
* Enable soft delete, versioning, and immutability policies for sensitive containers.

## Detection

Use the Azure Portal:

1. Open **Azure Portal** -> **Monitor** -> **Activity log** and filter for `Microsoft.Storage/storageAccounts/blobServices/containers/write` and public-access changes.
2. Review the storage account's **Containers** blade for any container with Blob or Container public access.
3. Review **Access control (IAM)** at account and container scope for unexpected data-plane role assignments.

## References

* <https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction>
* <https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-configure>
* <https://learn.microsoft.com/en-us/azure/role-based-access-control/scope-overview>