Network security groups should limit inbound TCP port 5900 access from the internet
The check relies on Trivy rule `AZU-0047`. That rule flags rules that allow unrestricted ingress from any IP address, so a finding means a rule exposes its target to traffic from every source instead of a limited set of addresses.
Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
What this control checks
Trivy check AZU-0047 looks at azurerm_network_security_rule and fails a rule that allows unrestricted ingress from any IP address. Trivy AZU-0047 passes when a more restrictive cidr range is set, for example a destination_address_prefix of 10.0.0.0/16 with direction set to Inbound. Powerpipe check network_security_group_restrict_inbound_tcp_port_5900 is titled "Network security groups should restrict inbound TCP port 5900 access from internet".
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.network_security_group_restrict_inbound_tcp_port_5900.
Scans of the Terraform code that flag the same setting before deployment: Trivy check AZU-0047.
Related controls
- SQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)
- Storage accounts should have the default network access rule set to deny
- Storage accounts should prohibit public access
- Container registries should have public network access disabled
- MariaDB servers should have public network access disabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_tcp_port_5900 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_tcp_port_5900 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13