PostgreSQL Database ingress traffic should be restricted to specified IP addresses


Ensure that no PostgreSQL Databases allow ingress from (ANY IP).


PostgreSQL Server includes a firewall to block access to unauthorized connections. More granular IP addresses can be defined by referencing the range of addresses available from specific datacenters.


Disabling Allow access to Azure Services will break all connections to PostgreSQL server and Hosted Databases unless custom IP specific rules are not added in Firewall Policy.


From the console

  1. Go to PostgreSQL servers
  2. For each PostgreSQL server, click on Firewall / Virtual Networks
  3. Set Allow access to Azure services to OFF
  4. Set firewall rules to limit access to only authorized connections

Using PowerShell

Disable default firewall rule “Allow access to Azure services”:

Remove-AzPostgreSqlFirewallRule -Name "AllowAllWindowsAzureIps" -ResourceGroupName <resource group name> -ServerName <server name>

Remove custom firewall rule:

Remove-AzPostgreSqlFirewallRule -Name <name> -ResourceGroupName <resource group name> -ServerName <server name>

Set the appropriate firewall rules:

New-AzPostgreSqlFirewallRule -Name "<rule name>" -ResourceGroupName "<resource group name>" -ServerName "<server name>" -EndIPAddress "<IP Address other than>" -StartIPAddress "<IP Address other than or>"