Network security groups should limit inbound TCP port 5432 access from the internet
Trivy check `AZU-0047` flags unrestricted ingress from any IP address. The same Trivy check `AZU-0047` identifies network security group rules that leave the port open to all sources, which covers rules with no restriction on the source address.
Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
What this control checks
Trivy AZU-0047 states that a security group rule should not allow unrestricted ingress from any IP address. Trivy AZU-0047 shows an azurerm_network_security_rule with direction set to Inbound and access set to Allow that uses a restrictive address prefix as the passing example. Trivy AZU-0047 says to restrict access to IP addresses or ranges that are explicitly required where possible.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.network_security_group_restrict_inbound_tcp_port_5432.
Scans of the Terraform code that flag the same setting before deployment: Trivy check AZU-0047.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_tcp_port_5432 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_tcp_port_5432 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13