ScoutSuite flags storage account incorrectly when 3 exceptions allowed

[Dziubey]

Description
When running ScoutSuite against our Azure infrastructure, an incorrect flag is given for the Trusted Microsoft Services Enabled rule for storage accounts.

We allow all 3 exceptions for our Azure storage accounts, as presented below:

1. Allow trusted Microsoft services to access this storage account
2. Allow read access to storage account loggin from any network
3. Allow read access to storage metrics from any network
   

However, ScoutSuite flags the storage account and says that the Trusted Microsoft Services are disabled.

To Reproduce

1. Create Azure storage account
2. Go to storage account -> Firewalls and virtual networks
3. Allow all three exceptions
4. Run ScoutSuite for the subscription where storage account has been deployed

The following CLI parameters have been used:

1. Azure
2. Subscription
3. Service-principal
4. Tenant
5. Client-id
6. Client-secret
7. Skip-aad

The full command executed to generate report:
python3 scout.py azure --subscription xxxx --service-principal --tenant xxxx --client-id xxxx --client-secret xxxx --skip aad

Additional context

ScoutSuite version 5.8.1 has been used.
We use default rules and conditions.

[x4v13r64]

Thank you @Dziubey, we'll look into it.

[ramimac]

@Dziubey Any chance you're able to run az storage account show --name NAME --query 'networkRuleSet.bypass'? This is the query primarily backing this findings, so it'll make debugging easier.

Further background: for now we are checking if it is equal to "AzureServices" to pass the check. I'm not the Azure guy so it may be we need to broaden this check

[Dziubey]

Hi @ramimac , apologies for the delayed reply. The output we received for two tested storage accounts was: "Logging, Metrics, AzureServices".
Please see the screenshot for reference:

Hope that helps. Just let me know if you would need any additional information.

[ramimac]

Awesome! Super helpful, I'll go get this rule refined.

[x4v13r64]

Closing, fixed in develop.