Network security groups should limit inbound TCP port 53 access from the internet
Trivy `AZU-0047` flags rules that allow unrestricted ingress from any IP address. Rules that permit ingress from any IP address, with no restriction to specific sources, are the ones it flags. This covers unrestricted ingress that is open to every IP address.
Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
What this control checks
Network security groups must not allow unrestricted inbound TCP port 53 access from the internet.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.network_security_group_restrict_inbound_tcp_port_53.
Scans of the Terraform code that flag the same setting before deployment: Trivy check AZU-0047.
Related controls
- Network security groups should have HTTP(S) access from the internet evaluated and restricted
- Network security groups should have Diagnostic Settings configured
- Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group
- Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_tcp_port_53 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_tcp_port_53 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13