Network security groups should limit inbound TCP port 20 access from the internet
Trivy `AZU-0047` says a security group rule should not allow unrestricted ingress from any IP address. The underlying guidance is that opening up ports to the public internet is generally to be avoided, so open access from any source address is discouraged.
Opening up ports to allow connections from the public internet is generally to be avoided.
What this control checks
Trivy AZU-0047 says to set a more restrictive cidr range, such as 10.0.0.0/16 for destination_address_prefix. Trivy AZU-0047 shows an allowed rule using source_address_prefix of a single public IP, 168.63.129.16.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.network_security_group_restrict_inbound_tcp_port_20.
Scans of the Terraform code that flag the same setting before deployment: Trivy check AZU-0047.
Related controls
- Network security groups should have HTTP(S) access from the internet evaluated and restricted
- Network security groups should have flow logs configured
- Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group
- Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group Rule
- Regions with newly created virtual networks should have Network Watcher deployed
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_tcp_port_20 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_tcp_port_20 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13