Azure PostgreSQL database flexible server configured with overly permissive network access misconfig

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_26
Category - Subcategory	Public Exposure - Ingress Controls
Provider	AZURE
Severity	MEDIUM
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	840a792d-f8a3-4331-b183-3eea67f519b8

Impact

This rule is verifying that Azure PostgreSQL Flexible server is not set up with excessively permissive network access. The rule is important because overly permissive network access can potentially expose the database server to a wider range of threats. It offers an increased attack surface for unauthorized individuals or programs to exploit. If network access isn't restricted, it can lead to data breaches or unauthorized alterations to the database, compromising the privacy, security and integrity of the data hosted on the server. Hence, it is recommended to provide only necessary access permissions to maintain the lowest level of risk and exposure.

How to Fix

Resource: azurerm_postgresql_flexible_server_firewall_rule

• Arguments: start_ip_address, end_ip_address

Your Terraform configuration should define azurerm_postgresql_flexible_server_firewall_rule resources with start_ip_address and end_ip_address values that do not allow access from any IP address (0.0.0.0 to 255.255.255.255). Here's how you might configure it:

Remember to replace the example IP addresses with the actual IP ranges that should be allowed to access your server. [source,go]

resource "azurerm_postgresql_flexible_server_firewall_rule" "example" { name = "example-firewall-rule" resource_group_name = azurerm_resource_group.example.name server_name = azurerm_postgresql_flexible_server.example.name

• start_ip_address = "10.0.0.4" // Specific IP or range, not 0.0.0.0
• end_ip_address = "10.0.0.20" // Specific IP or range, not 255.255.255.255 }

---