Azure PostgreSQL Database Server 'Allow access to Azure services' enabled misconfiguration detected

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_6
Category - Subcategory	Public Exposure - Database Endpoints
Provider	AZURE
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	dfa7d61c-d608-45a7-b9fd-adecd6da1f25

Impact

When 'Allow access to Azure services' settings are enabled, PostgreSQL Database server will accept connections from all Azure resources as well as from other subscription resources. It is recommended to use firewall rules or VNET rules to allow access from specific network ranges or virtual networks.

How to Fix

[source,go]

resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" }

resource "azurerm_sql_server" "sql_server_good" { name = "mysqlserver" resource_group_name = azurerm_resource_group.example.name location = "West US" version = "12.0" administrator_login = "4dm1n157r470r" administrator_login_password = "4-v3ry-53cr37-p455w0rd" }

resource "azurerm_sql_firewall_rule" "firewall_rule_good" { name = "FirewallRule1" resource_group_name = azurerm_resource_group.example.name server_name = azurerm_sql_server.sql_server_good.name start_ip_address = "10.0.17.62" end_ip_address = "10.0.17.62" }