PostgreSQL Database ingress traffic should be restricted to specified IP addresses

azure.security

Description

Ensure that no PostgreSQL Databases allow ingress from 0.0.0.0/0 (ANY IP).

Rationale

PostgreSQL Server includes a firewall to block access to unauthorized connections. More granular IP addresses can be defined by referencing the range of addresses available from specific datacenters.

Impact

Disabling Allow access to Azure Services will break all connections to PostgreSQL server and Hosted Databases unless custom IP specific rules are not added in Firewall Policy.

Remediation

From the console

  1. Go to PostgreSQL servers
  2. For each PostgreSQL server, click on Firewall / Virtual Networks
  3. Set Allow access to Azure services to OFF
  4. Set firewall rules to limit access to only authorized connections

Using PowerShell

Disable default firewall rule “Allow access to Azure services”:

Remove-AzPostgreSqlFirewallRule -Name "AllowAllWindowsAzureIps" -ResourceGroupName <resource group name> -ServerName <server name>

Remove custom firewall rule:

Remove-AzPostgreSqlFirewallRule -Name <name> -ResourceGroupName <resource group name> -ServerName <server name>

Set the appropriate firewall rules:

New-AzPostgreSqlFirewallRule -Name "<rule name>" -ResourceGroupName "<resource group name>" -ServerName "<server name>" -EndIPAddress "<IP Address other than 0.0.0.0>" -StartIPAddress "<IP Address other than 0.0.0.0 or 255.255.255.255>"

References

  1. https://docs.microsoft.com/en-us/azure/postgresql/concepts-firewall-rules