Control: 4.3.7 Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled

Description

Disable access from Azure services to PostgreSQL Database Server.

If access from Azure services is enabled, the server's firewall will accept connections from all Azure resources, including resources not in your subscription. This is usually not a desired configuration. Instead, set up firewall rules to allow access from specific network ranges or VNET rules to allow access from specific virtual networks.

Remediation

From Azure Portal

Login to Azure Portal using https://portal.azure.com.
Go to Azure Database for PostgreSQL servers.
For each database, click on Connection security.
Under Firewall rules, set Allow access to Azure services to No.
Click Save.

From Azure CLI

Use the below command to delete the AllowAllWindowsAzureIps rule for PostgreSQL Database.

az postgres server firewall-rule delete --name AllowAllWindowsAzureIps -- resource-group <resourceGroupName> --server-name <serverName>

Default Value

The Azure Postgres firewall is set to block all access by default.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v200_4_3_7

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v200_4_3_7 --share

SQL

This control uses a named query:

with postgres_db_with_allow_access_to_azure_services as (
  select
    id
  from
    azure_postgresql_server,
    jsonb_array_elements(firewall_rules) as r
  where
    r -> 'FirewallRuleProperties' ->> 'endIpAddress' = '0.0.0.0'
    and r -> 'FirewallRuleProperties' ->> 'startIpAddress' = '0.0.0.0'
)
select
  s.id as resource,
  case
    when a.id is not null then 'alarm'
    else 'ok'
  end as status,
  case
    when a.id is not null then s.title || ' does not restrict access to azure services.'
    else s.title || ' restricts access to azure services.'
  end as reason
  
  , s.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_postgresql_server as s
  left join postgres_db_with_allow_access_to_azure_services as a on a.id = s.id,
  azure_subscription as sub
where
  sub.subscription_id = s.subscription_id;