Example - 1

The following Azure command updates the settings for a storage account:

az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access true

However, "Allow Blob Public Access" is set to true, meaning that anonymous/public users can access blobs.

The command could be modified to disable "Allow Blob Public Access" by setting it to false.

az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access false

Example - 2

The following Google Cloud Storage command gets the settings for a storage account named 'BUCKET_NAME':

gsutil iam get gs://BUCKET_NAME

Suppose the command returns the following result:

"projectEditor: PROJECT-ID","projectOwner: PROJECT-ID"
"members":[],"role":"roles/storage.legacyBucketOwner"

"allUsers","projectViewer: PROJECT-ID"],"role":"roles/storage.legacyBucketReader"
"members":[}
"bindings":[{},{]
{}

This result includes the "allUsers" or IAM role added as members, causing this policy configuration to allow public access to cloud storage resources. There would be a similar concern if "allAuthenticatedUsers" was present.

The command could be modified to remove "allUsers" and/or "allAuthenticatedUsers" as follows:

gsutil iam ch -d allUsers gs://BUCKET_NAMEgsutil iam ch -d allAuthenticatedUsers gs://BUCKET_NAME