MariaDB servers should have public network access disabled

Disable the public network access property so Azure Database for MariaDB can only be accessed from a private endpoint. This configuration denies all logins that match IP or virtual network-based firewall rules.

This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules. Database resources should not publicly available. You should limit all access to the minimum that is required for your application to function.

What this control checks

MariaDB servers must have publicNetworkAccess set to Disabled

Common pitfalls

Omitting the argument still fails the check

Positive test num. 2 - tf file

Audit evidence

Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Public network access should be disabled for MariaDB servers" (fdccbe47-f3e3-4213-ad5d-ea459b2fa077); PowerPipe control azure_compliance.control.mariadb_server_public_network_access_disabled.

Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_48; KICS query "MariaDB Server Public Network Access Enabled" (7f0a8696-7159-4337-ad0d-8a3ab4a78195); Trivy check AZU-0022.

Framework-specific interpretation

NIST SP 800-53 Rev 5: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).

FedRAMP Moderate Baseline Rev 4: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).

Framework mappings

The clauses this control is mapped to in each framework.

NIST SP 800-53 Rev 5

Information Flow Enforcement (AC-4)
SC-7: Boundary Protection
SC-7(3) Access Points

FedRAMP Moderate Baseline Rev 4

AC-4 Information Flow Enforcement
SC-7: Boundary Protection
SC-7(3) Access Points

NIST SP 800-171 Rev 2

3.1.3 Control the flow of CUI in accordance with approved authorizations
3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

CIS Azure Benchmark v4.0.0

2.2.1.1 Ensure public network access is Disabled

CMMC 2.0 Level 2

AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)

FedRAMP High

AC-4 Information Flow Enforcement
SC-7 Boundary Protection
SC-7(3) Access Points

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: mariadb_server_public_network_access_disabled
Checkov Check: CKV_AZURE_48
Powerpipe Control: azure_compliance.control.mariadb_server_public_network_access_disabled
Azure Policy Definition: fdccbe47-f3e3-4213-ad5d-ea459b2fa077
KICS Query: 7f0a8696-7159-4337-ad0d-8a3ab4a78195
Trivy Check: AZU-0022

Last reviewed: 2026-10-13

View all Azure controls →