Back to Checks
azure

PostgreSQL flexible server has 'Allow public access from any Azure service' disabled

postgresql_flexible_server_allow_access_services_disabled
Service: postgresqlSeverity: high
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:microsoft.dbforpostgresql/flexibleservers

Azure Database for PostgreSQL Flexible Server firewall should not include the rule that allows connections from any Azure service, represented by start_ip=0.0.0.0 and end_ip=0.0.0.0.

Prowler logoProwlerprowler-provider-azure

Risk

Allowing all Azure services erodes network isolation, permitting unsolicited connections from other subscriptions and tenants. This enables credential brute force and unauthorized access paths, risking data confidentiality and integrity, and increasing the chance of service disruption (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks postgresql_flexible_server_allow_access_services_disabled

Recommendation

Remove the 0.0.0.0 rule and apply least privilege:

  • Use Private Endpoints for access
  • Allow only required source IP ranges
  • Isolate with VNET rules and NSGs
  • Enforce TLS and strong authentication
  • Monitor connection logs for anomalies

Remediation

CLI

az postgres flexible-server firewall-rule delete --resource-group <resourceGroupName> --name <serverName> --rule-name <rule_name>

Terraform

# Update the existing rule to not use 0.0.0.0 (disables "Allow Azure services")
resource "azurerm_postgresql_flexible_server_firewall_rule" "<example_resource_name>" {
  name             = "<example_rule_name>"
  server_id        = "<example_resource_id>"
  start_ip_address = "<START_IP>" # critical: not 0.0.0.0
  end_ip_address   = "<END_IP>"   # critical: not 0.0.0.0
}

NativeIaC

// Update the existing firewall rule that allowed Azure services (0.0.0.0) to a specific IP/range
resource fwRule 'Microsoft.DBforPostgreSQL/flexibleServers/firewallRules@2023-03-01-preview' = {
  name: '<example_server_name>/<example_rule_name>'
  properties: {
    startIpAddress: '<START_IP>' // critical: not 0.0.0.0; disables "Allow Azure services"
    endIpAddress: '<END_IP>'     // critical: not 0.0.0.0
  }
}

Other

1In Azure Portal, go to Azure Database for PostgreSQL flexible server and select your server
2Open Networking > Firewall rules
3Find the rule where Start IP and End IP are both 0.0.0.0
4Select it and click Delete
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.postgresql.postgresql_client import (
    postgresql_client,
)


class postgresql_flexible_server_allow_access_services_disabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for (
            subscription,
            flexible_servers,
        ) in postgresql_client.flexible_servers.items():
            subscription_name = postgresql_client.subscriptions.get(
                subscription, subscription
            )
            for server in flexible_servers:
                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has allow public access from any Azure service enabled"
                if not any(
                    rule.start_ip == "0.0.0.0" and rule.end_ip == "0.0.0.0"
                    for rule in server.firewall
                ):
                    report.status = "PASS"
                    report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has allow public access from any Azure service disabled"
                findings.append(report)

        return findings

References