MySQL servers should have public network access disabled
Disable the public network access property so your Azure Database for MySQL can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range.
Disable the public network access property to improve security and ensure your Azure Database for MySQL can only be accessed from a private endpoint.
What this control checks
MySQL servers must have public network access set to Disabled
Common pitfalls
Disabling public access blocks IP and VNet rule logins
This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Public network access should be disabled for MySQL servers" (d9844e8a-1437-4aeb-a32c-0c992f056095); PowerPipe control azure_compliance.control.mysql_server_public_network_access_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_53; KICS query "MySQL Server Public Access Enabled" (f118890b-2468-42b1-9ce9-af35146b425b); Trivy check AZU-0022.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 2.2.1.1 Ensure public network access is Disabled
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
mysql_server_public_network_access_disabled - Checkov Check:
CKV_AZURE_53 - Powerpipe Control:
azure_compliance.control.mysql_server_public_network_access_disabled - Azure Policy Definition:
d9844e8a-1437-4aeb-a32c-0c992f056095 - KICS Query:
f118890b-2468-42b1-9ce9-af35146b425b - Trivy Check:
AZU-0022
Last reviewed: 2026-10-13