Description:
Disable access from Azure services to PostgreSQL Database Server.
Rationale:
If access from Azure services is enabled, the server's firewall will accept connections from all Azure resources, including resources not in your subscription. This is usually not a desired configuration. Instead, set up firewall rules to allow access from specific network ranges or VNET rules to allow access from specific virtual networks.
Audit:
From Azure Portal
1. Login to Azure Portal using https://portal.azure.com.
2. Go to Azure Database for PostgreSQL servers.
3. For each database, click on Connection security.
4. Under Firewall rules, ensure Allow access to Azure services is set to No.
From Azure CLI
Ensure the output of the below command does not include a rule with the name
AllowAllWindowsAzureIps or "startIpAddress": "0.0.0.0" & "endIpAddress": "0.0.0.0",
az postgres server firewall-rule list --resource-group <resourceGroupName> -
-server <serverName>Remediation:
From Azure Portal
1. Login to Azure Portal using https://portal.azure.com.
2. Go to Azure Database for PostgreSQL servers.
3. For each database, click on Connection security.
4. Under Firewall rules, set Allow access to Azure services to No.
5. Click Save.
From Azure CLI
Use the below command to delete the AllowAllWindowsAzureIps rule for PostgreSQL
Database.
az postgres server firewall-rule delete --name AllowAllWindowsAzureIps --
resource-group <resourceGroupName> --server-name <serverName>Default Value:
The Azure Postgres firewall is set to block all access by default.
References:
1. https://docs.microsoft.com/en-us/azure/postgresql/concepts-firewall-rules
2. https://docs.microsoft.com/en-us/azure/postgresql/howto-manage-firewall-usingcli
3. https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-network-security#ns-1-establish-network-segmentation-boundaries