Allowing large IP ranges in Azure SQL firewall rules broadens the database attack surface and increases the risk of unauthorized access, brute-force attempts, and data exposure. Firewall rules should grant the minimal address range required.
For Ansible tasks using azure_rm_sqlfirewallrule or azure.azcollection.azure_rm_sqlfirewallrule, ensure the start_ip_address and end_ip_address properties are defined and that the numeric difference between them is less than 256 (that is, a single IP or up to 255 addresses). Tasks that omit these properties, set either address to 0.0.0.0, or specify a range with difference >= 256 are flagged as insecure.
Secure configuration example:
- name:Allow single client IP to Azure SQL firewallazure.azcollection.azure_rm_sqlfirewallrule:resource_group:my-rgserver_name:my-sql-servername:allow-clientstart_ip_address:203.0.113.45end_ip_address:203.0.113.45
Compliant Code Examples
#this code is a correct code for which the query should not find any result- name:Create (or update) Firewall Ruleazure_rm_sqlfirewallrule:resource_group:myResourceGroupserver_name:firewallrulecrudtest-6285name:firewallrulecrudtest-5370start_ip_address:172.28.10.136end_ip_address:172.28.10.138
Non-Compliant Code Examples
#this is a problematic code where the query should report a result(s)- name:Create (or update) Firewall Rule1azure_rm_sqlfirewallrule:resource_group:myResourceGroup1server_name:firewallrulecrudtest-6285name:firewallrulecrudtest-5370start_ip_address:0.0.0.0end_ip_address:172.28.11.138- name:Create (or update) Firewall Rule2azure_rm_sqlfirewallrule:resource_group:myResourceGroup2server_name:firewallrulecrudtest-6285name:firewallrulecrudtest-5370start_ip_address:172.28.10.136end_ip_address:172.28.11.138
1
2
rulesets:- Ansible / Azure # Rules to enforce / Azure.
맞춤형 데모 요청
Datadog 시작하기
Ask AI
AI-generated responses may be inaccurate. Verify important info.
