Control: 4.3.7 Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled
Description
Disable access from Azure services to PostgreSQL Database Server.
If access from Azure services is enabled, the server's firewall will accept connections from all Azure resources, including resources not in your subscription. This is usually not a desired configuration. Instead, set up firewall rules to allow access from specific network ranges or VNET rules to allow access from specific virtual networks.
Remediation
From Azure Portal
- Login to Azure Portal using https://portal.azure.com.
- Go to
Azure Database for PostgreSQL servers. - For each database, click on
Connection security. - Under
Firewall rules, setAllow access to Azure servicestoNo. - Click
Save.
From Azure CLI
Use the below command to delete the AllowAllWindowsAzureIps rule for PostgreSQL Database.
az postgres server firewall-rule delete --name AllowAllWindowsAzureIps -- resource-group <resourceGroupName> --server-name <serverName>
Default Value
The Azure Postgres firewall is set to block all access by default.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v200_4_3_7Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v200_4_3_7 --shareSQL
This control uses a named query:
postgres_db_server_allow_access_to_azure_services_disabled