lacework-global-549
4.3.7 Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled (Automated)
note
This rule has been changed to automated, see Automated Rules for CIS Azure 1.5.0 for details.
Profile Applicability
• Level 1
Description
Disable access from Azure services to PostgreSQL Database Server
Rationale
If access from Azure services is enabled, the server's firewall will accept connections from all Azure resources, including resources not in your subscription. This is usually not a desired configuration. Instead, set up firewall rules to allow access from specific network ranges or VNET rules to allow access from specific virtual networks.
Audit
From Azure Portal
- Login to Azure Portal using https://portal.azure.com
- Go to
Azure Database
forPostgreSQL server
- For each database, click on
Connection security
- In
Firewall rules
- Ensure Allow access to Azure services is set to
OFF
.
From Azure CLI
Ensure the output of the below command does not include a rule with the name AllowAllAzureIps or "startIpAddress": "0.0.0.0" & "endIpAddress": "0.0.0.0",
az postgres server firewall-rule list --resource-group <resourceGroupName> --server <serverName>
Remediation
From Azure Portal
- Login to Azure Portal using https://portal.azure.com
- Go to
Azure Database
forPostgreSQL server
- For each database, click on
Connection security
- In
Firewall rules
- Ensure Allow access to Azure services is set to
OFF
. - Click
Save
to apply the changed rule.
From Azure CLI
Use the below command to delete the AllowAllAzureIps rule for PostgreSQL Database.
az postgres server firewall-rule delete --name AllowAllAzureIps --resource-group <resourceGroupName> --server-name <serverName>
References
https://docs.microsoft.com/en-us/azure/postgresql/concepts-firewall-rules
https://docs.microsoft.com/en-us/azure/postgresql/howto-manage-firewall-using-cli
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-network-security#ns-1-establish-network-segmentation-boundaries
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-network-security#ns-6-deploy-web-application-firewall