Web application firewall for Azure storage account

Question

We have an Azure storage account which has static HTML content for a website. Instead of exposing the storage account URL on the Internet, an Azure CDN endpoint was created https://ourendpoint.azureedge.net/ which is exposed to outside world.

A. Does Azure CDN come with a web application firewall which is what our business analyst claims? I thought only Azure Front Door and Azure application gateway had it?

B. Stateful Inspection – Does Azure CDN only provide this? The business analyst claims no Azure Front Door or Azure App Gateway is needed as we are using a CDN endpoint

C. Intrusion Prevention – Does Azure CDN only provide this? The business analyst claims no Azure Front Door or Azure App Gateway is needed as we are using a CDN endpoint

D. Anti-Malware – I understand we receive Microsoft Defender ATP and the price for a storage account using Azure Standard Tier of Security Center from https://azure.microsoft.com/en-us/pricing/details/security-center/ is $0.02/10K transactions. What counts as a transaction for a storage account?

E. To protect the storage account from being accessed from Internet, the server admin went to Storage Account->Configuration->Disable Blob public access. Then, a CDN endpoint was configured so users on the Internet could use that to access the static website. Is that secure enough to prevent any user on the Internet from accessing the storage account directly? The business analyst claims no Azure Front Door or Azure App Gateway is needed as we are using a CDN endpoint and this should be secure enough.

F. Is there a WAF solution outside of Azure Front Door, Azure Application gateway which can be used for protecting storage accounts which is free for 5 rules? I don't know where our business analyst got that idea and is suggesting to use that as a cheap option. Does anything like this exist in Azure for protecting storage accounts?

Answer 1

Hi Chris,

A. It is in preview stage so I would go with Azure Application Gateway or Front Door
B,C As far as I know no as CDN is not for that.
D. It refers to number of access attempts at your storage account
E. Yes, it helps but it is not secure enough and you need other defenses like a web application firewall, standard tier of Azure security etc.
F. No, I would ask the business analyst about the source of this information

Microsoft employees in this forum should be able to offer more advice. Ajay, in particular, is very helpful and knowledgeable.

Answer 2

@Chris

A. Does Azure CDN come with a web application firewall which is what our business analyst claims? I thought only Azure Front Door and Azure application gateway had it?

• WAF can be deployed as an add on with Azure Application Gateway, Azure Front Door, and Azure Content Delivery Network (CDN) service from Microsoft. However, Azure WAF on Azure CDN is currently under public preview- As given in document- https://learn.microsoft.com/en-us/azure/web-application-firewall/overview

B. Stateful Inspection – Does Azure CDN only provide this? The business analyst claims no Azure Front Door or Azure App Gateway is needed as we are using a CDN endpoint

C. Intrusion Prevention – Does Azure CDN only provide this? The business analyst claims no Azure Front Door or Azure App Gateway is needed as we are using a CDN endpoint

• Azure CDN does not provide the above two features. However, it does provide security features such as Geo-filtering, DDOS protection, Token authentication etc.,
  If you need additional security, you can enable WAF for CDN which will provide an extra layer of security.

"WAF defends your web services against common exploits and vulnerabilities. It keeps your service highly available for your users and helps you meet compliance requirements."

The security features that WAF for CDN provides are given here in document- https://learn.microsoft.com/en-us/azure/web-application-firewall/cdn/cdn-overview

D. Anti-Malware – I understand we receive Microsoft Defender ATP and the price for a storage account using Azure Standard Tier of Security Center from https://azure.microsoft.com/en-us/pricing/details/security-center/ is $0.02/10K transactions. What counts as a transaction for a storage account?

• Please reach out to customer support regarding pricing questions.

E. To protect the storage account from being accessed from Internet, the server admin went to Storage Account->Configuration->Disable Blob public access. Then, a CDN endpoint was configured so users on the Internet could use that to access the static website. Is that secure enough to prevent any user on the Internet from accessing the storage account directly? The business analyst claims no Azure Front Door or Azure App Gateway is needed as we are using a CDN endpoint and this should be secure enough.

• With Azure CDN, it will access the storage account from any of its POP IPs. Therefore, you can still block all internet traffic but still need to allow these IPs. More information on this is here- https://learn.microsoft.com/en-us/azure/cdn/cdn-pop-list-api
  If you are looking for security with CDN, as discussed previously, WAF can be implemented.

F. Is there a WAF solution outside of Azure Front Door, Azure Application gateway which can be used for protecting storage accounts which is free for 5 rules? I don't know where our business analyst got that idea and is suggesting to use that as a cheap option. Does anything like this exist in Azure for protecting storage accounts?

• WAF is a solution by itself and comes as an add on to the Azure Front Door, Azure Application gateway and Azure CDN services. Azure CDN pricing is given here at- https://azure.microsoft.com/en-us/pricing/details/web-application-firewall/
  Azure WAF pricing ca be referred to here- https://azure.microsoft.com/en-us/pricing/details/web-application-firewall/

If you have any further questions/concerns, please feel free to reach us out anytime and we will be glad to assist you further. Thank you!