SQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)
Azure SQL Server accessibility should be set to a minimal address range. Prowler looks for a server firewall rule that allows 0.0.0.0 to 255.255.255.255. An Internet-wide rule permits unsolicited access from any host.
An Internet-wide rule permits unsolicited access from any host, enabling mass scanning, brute force, and exploitation of weak configurations.
What this control checks
SQL server firewall rules must not allow 0.0.0.0 to 255.255.255.255 (ANY IP)
Common pitfalls
Avoid broad exceptions like Allow Azure services
Avoid broad exceptions like Allow Azure services and never use 0.0.0.0/0.
Audit evidence
Evidence that deployed resources meet this control: Prowler check sqlserver_unrestricted_inbound_access (prowler azure --checks sqlserver_unrestricted_inbound_access); PowerPipe control azure_compliance.control.sql_database_allow_internet_access.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Unrestricted SQL Server Access" (d7ba74da-2da0-4d4b-83c8-2fd72a3f6c28).
Framework-specific interpretation
PCI DSS v4.0: Mapped to 1.2.8 (Network security controls (NSCs) are configured and maintained.), 1.3.1 (Network access to and from the cardholder data environment is restricted.), 1.3.2 (Network access to and from the cardholder data environment is restricted.) and 7 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
5 more clauses
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- 6.3 Ensure no SQL Databases allow ingress 0.0.0.0/0 (ANY IP)
- 6.3 Ensure no SQL Databases allow ingress 0.0.0.0/0 (ANY IP)
- 4.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)
- 4.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)
- 4.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)
- 5.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(i) Workforce security
- 164.312(a)(1) Access control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_database_allow_internet_access - Powerpipe Control:
azure_compliance.control.sql_database_allow_internet_access - Prowler Check:
sqlserver_unrestricted_inbound_access - KICS Query:
d7ba74da-2da0-4d4b-83c8-2fd72a3f6c28
Last reviewed: 2026-10-15