Network security groups should limit inbound TCP port 4333 access from the internet
Network security group provide stateful filtering of inbound/outbound network traffic to Azure resources. It is recommended that no network security group allows unrestricted inbound access to TCP port 4333.
Opening up ports to allow connections from the public internet is generally to be avoided.
What this control checks
Checks network security group rules that allow inbound TCP port 4333
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.network_security_group_restrict_inbound_tcp_port_4333.
Scans of the Terraform code that flag the same setting before deployment: Trivy check AZU-0047.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_tcp_port_4333 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_tcp_port_4333 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13