PostgreSQL servers should have private endpoints enabled
Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for PostgreSQL. Configure a private endpoint connection to enable access to traffic coming only from known networks.
Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for PostgreSQL. Configure a private endpoint connection to enable access to traffic coming only from known networks and prevent access from all other IP addresses, including within Azure.
What this control checks
PostgreSQL servers should have private endpoints enabled
Common pitfalls
Only Approved connections pass the check
The existence condition requires privateLinkServiceConnectionState.status to equal Approved.
Effect can be set to Disabled
The effect parameter has a defaultValue of AuditIfNotExists. Its allowedValues are AuditIfNotExists and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Private endpoint should be enabled for PostgreSQL servers" (0564d078-92f5-4f97-8398-b9f58a51f70b); PowerPipe control azure_compliance.control.postgres_server_private_link_used.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control), AC-4 (Information Flow Enforcement) and 2 more clauses.
FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access), AC-17(1) (Automated Monitoring/Control), AC-4 (Information Flow Enforcement) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.1.12: Monitor and control remote access sessions.
- 3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- 3.1.14 Route remote access via managed access control points
3 more clauses
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 2.2.2.1 Ensure Private Endpoints are used to access {service}
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- AC.L2-3.1.12 Monitor and control remote access sessions
- AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- AC.L2-3.1.14 Route remote access via managed access control points
3 more clauses
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- AC-4 Information Flow Enforcement
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
- Event Hub namespaces should use private link
- Storage accounts should prohibit public access
- Cosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networks
- Service Bus namespaces should not allow overly permissive network access
- Container registries should not allow unrestricted network access
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
postgres_server_private_link_used - Powerpipe Control:
azure_compliance.control.postgres_server_private_link_used - Azure Policy Definition:
0564d078-92f5-4f97-8398-b9f58a51f70b
Last reviewed: 2026-10-14