SQLServer ingress from any IP

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: ansible-azure-sql-server-ingress-from-any-ip

Provider: Azure

Platform: Ansible

Severity: Critical

Category: Networking and Firewall

Learn More

Description

Allowing an Azure SQL firewall rule to accept connections from the entire internet (start_ip_address set to 0.0.0.0 and end_ip_address set to 255.255.255.255) exposes database servers to unauthorized access and credential brute-force attacks.

This rule checks Ansible resources using the azure.azcollection.azure_rm_sqlfirewallrule (or azure_rm_sqlfirewallrule) module. Resources with start_ip_address set to 0.0.0.0 and end_ip_address set to 255.255.255.255 are flagged. Restrict firewall rules to specific client IPs or CIDR ranges, or use virtual network-based rules to limit access.

Secure example with a single allowed IP:

- name: Add SQL firewall rule for a specific IP
  azure.azcollection.azure_rm_sqlfirewallrule:
    resource_group: myResourceGroup
    server_name: my-sql-server
    name: allow-office-ip
    start_ip_address: 203.0.113.5
    end_ip_address: 203.0.113.5
    state: present

Compliant Code Examples

- name: Create (or update) Firewall Rule
  azure.azcollection.azure_rm_sqlfirewallrule:
    resource_group: myResourceGroup
    server_name: firewallrulecrudtest-6285
    name: firewallrulecrudtest-5370
    start_ip_address: 172.28.10.136
    end_ip_address: 172.28.10.138
- name: Create (or update) Firewall Rule2
  azure.azcollection.azure_rm_sqlfirewallrule:
    resource_group: myResourceGroup
    server_name: firewallrulecrudtest-6285
    name: firewallrulecrudtest-5370
    start_ip_address: 0.0.0.0
    end_ip_address: 0.0.0.3
- name: Create (or update) Firewall Rule3
  azure.azcollection.azure_rm_sqlfirewallrule:
    resource_group: myResourceGroup
    server_name: firewallrulecrudtest-6285
    name: firewallrulecrudtest-5370
    start_ip_address: 255.255.255.250
    end_ip_address: 255.255.255.255

Non-Compliant Code Examples

---
- name: Create (or update) Firewall Rule
  azure.azcollection.azure_rm_sqlfirewallrule:
    resource_group: myResourceGroup
    server_name: firewallrulecrudtest-6285
    name: firewallrulecrudtest-5370
    start_ip_address: 0.0.0.0
    end_ip_address: 255.255.255.255