Check ID: postgresql_flexible_server_allow_access_services_disabled
Provider: Azure
Service: postgresql
Severity: HIGH
Categories: trust-boundaries
Resource type: microsoft.dbforpostgresql/flexibleservers

What this check verifies

Azure Database for PostgreSQL Flexible Server firewall should not include the rule that allows connections from any Azure service, represented by start_ip=0.0.0.0 and end_ip=0.0.0.0.

Risk

Allowing all Azure services erodes network isolation, permitting unsolicited connections from other subscriptions and tenants. This enables credential brute force and unauthorized access paths, risking data confidentiality and integrity, and increasing the chance of service disruption (availability).

Recommendation

Remove the 0.0.0.0 rule and apply least privilege:
  • Use Private Endpoints for access
  • Allow only required source IP ranges
  • Isolate with VNET rules and NSGs
  • Enforce TLS and strong authentication
  • Monitor connection logs for anomalies

Remediation

az postgres flexible-server firewall-rule delete —resource-group <resourceGroupName> —name <serverName> —rule-name <rule_name>

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = postgresql_flexible_server_allow_access_services_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks