Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
postgresql_flexible_server_allow_access_services_disabledProvider: Azure
Service:
postgresqlSeverity: HIGH
Categories:
trust-boundariesResource type:
microsoft.dbforpostgresql/flexibleserversWhat this check verifies
Azure Database for PostgreSQL Flexible Server firewall should not include the rule that allows connections from any Azure service, represented bystart_ip=0.0.0.0 and end_ip=0.0.0.0.
Risk
Allowing all Azure services erodes network isolation, permitting unsolicited connections from other subscriptions and tenants. This enables credential brute force and unauthorized access paths, risking data confidentiality and integrity, and increasing the chance of service disruption (availability).Recommendation
Remove the0.0.0.0 rule and apply least privilege:
- Use Private Endpoints for access
- Allow only required source IP ranges
- Isolate with VNET rules and NSGs
- Enforce TLS and strong authentication
- Monitor connection logs for anomalies
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az postgres flexible-server firewall-rule delete —resource-group <resourceGroupName> —name <serverName> —rule-name <rule_name>
References
- https://learn.microsoft.com/en-us/cli/azure/postgres/flexible-server/firewall-rule?view=azure-cli-latest
- https://learn.microsoft.com/en-us/azure/postgresql/network/how-to-networking-servers-deployed-public-access-disable-public-access?tabs=portal-disable-public-access
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/PostgreSQL/disable-all-services-access.html#
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = postgresql_flexible_server_allow_access_services_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks