Network security groups should limit inbound TCP port 445 access from the internet
Trivy `AZU-0047` flags unrestricted ingress from any IP address. This covers inbound rules that are open to every source address, so the check reports rules that accept traffic from any source instead of a limited set of addresses.
Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
What this control checks
Trivy AZU-0047 checks that a security group rule does not allow unrestricted ingress from any IP address. Its Terraform example uses azurerm_network_security_rule with direction set to Inbound and a restrictive address prefix such as 10.0.0.0/16. It advises restricting access to IP addresses or ranges that are explicitly required.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.network_security_group_restrict_inbound_tcp_port_445.
Scans of the Terraform code that flag the same setting before deployment: Trivy check AZU-0047.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_tcp_port_445 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_tcp_port_445 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13