# Ensure File Storage Shares Are Restricted to Specific Networks

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826036173669-ensure-file-storage-shares-are-restricted-to-specific-networks
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure each Public Cloud File Storage share allows access only from specific IP addresses or private network ranges through its access rules, rather than from any address.

**Rationale**

A file share open to broad ranges can be mounted by any system on those networks, which may expose or allow changes to shared files. Limiting access to the specific servers or subnets that need it protects the data from unauthorized systems.

**Impact**

-   Only approved systems can mount the share
    
-   Protects shared files from unauthorized access
    
-   New servers must be added to the access rules
    

**Default Value**

Access to a share is controlled by ACL rules that list the allowed client IP addresses or CIDR ranges. File Storage can only be used with OVHcloud IPs (Public Cloud and Managed Kubernetes Service).

**Pre-Requisites**

-   Permission to manage File Storage in the Public Cloud project
    
-   A list of IP addresses or ranges that need access
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select File Storage and click the share to open its dashboard.
    
4.  Open the Access Control List (ACL) tab and flag rules that allow broad ranges or clients that no longer need access.
    
5.  If any are found, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  Open the share's Access Control List (ACL) tab and click Add a new access.
    
4.  Enter the private IP address or CIDR range of each client that needs access, select the permission (read/write or read-only), and confirm.
    
5.  Delete rules that allow broad ranges or clients that no longer need access.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  Open the share's Access Control List (ACL) tab and add back the removed rules with Add a new access.
    

**Reference**

-   [https://docs.ovhcloud.com/en/guides/storage-and-backup/file-storage/file-storage-service/getting-started](https://docs.ovhcloud.com/en/guides/storage-and-backup/file-storage/file-storage-service/getting-started)
    
-   [https://docs.ovhcloud.com/en/guides/storage-and-backup/file-storage/file-storage-service/key-concepts](https://docs.ovhcloud.com/en/guides/storage-and-backup/file-storage/file-storage-service/key-concepts)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.