Control: 4.3.7 Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled

Description

Disable access from Azure services to PostgreSQL Database Server

If access from Azure services is enabled, the server's firewall will accept connections from all Azure resources, including resources not in your subscription. This is usually not a desired configuration. Instead, set up firewall rules to allow access from specific network ranges or VNET rules to allow access from specific virtual networks.

Remediation

From Azure Console

Login to Azure Portal using https://portal.azure.com
Go to Azure Database for PostgreSQL server
For each database, click on Connection security
In Firewall rules
Ensure Allow access to Azure services is set to OFF.
Click Save to apply the changed rule.

From Azure CLI

Use the below command to delete the AllowAllAzureIps rule for PostgreSQL Database.

az postgres server firewall-rule delete --name AllowAllAzureIps --resourcegroup <resourceGroupName> --server-name <serverName>

Default Value

The Azure Postgres firewall is set to block all access by default.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v150_4_3_7

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v150_4_3_7 --share

SQL

This control uses a named query:

manual_control