Network security groups should limit inbound TCP port 3306 access from the internet
This control uses Trivy rule `AZU-0047` to perform its check. Trivy rule `AZU-0047` flags unrestricted ingress from any IP address, so the control is built on the detection of unrestricted ingress from any IP address by that rule.
Opening up ports to allow connections from the public internet is generally to be avoided.
What this control checks
Trivy AZU-0047 recommends restricting access to IP addresses or ranges that are explicitly required. It also recommends setting a more restrictive cidr range.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.network_security_group_restrict_inbound_tcp_port_3306.
Scans of the Terraform code that flag the same setting before deployment: Trivy check AZU-0047.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_tcp_port_3306 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_tcp_port_3306 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13