rules/findings/azure/databases/azure_database_mysql/azure-mysql-public-network-access-enabled.json
|
{
"provider": "Azure", "serviceType": "Database for MySQL", "serviceName": "Databases", "displayName": "Ensure \u0060Public Network Access\u0060 is \u0060Disabled\u0060 for Azure Database for MySQL", "description": "Setting public networks to disabled prevents requests from the public internet.", "rationale": "Disabling public network access prevents Azure Database for PostgreSQL servers from communicating with the public internet and requires the use of Private endpoints for granular network control and segmentation.", "impact": "Disabling \u0027Public Network Access\u0027 forces the requirement of the use of Private Endpoints for network connectivity which will require some additional consideration from a network architecture perspective and will introduce cost based on the inbound/outbound data being processed by the Private Endpoint.", "remediation": { "text": "Remediate from Azure Portal 1. From Azure Database for PostgreSQL select the database you wish to remediate. 2. In the left column expand \u003E Settings. 3. Select Networking. 4. Uncheck the checkbox under Public Access", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/mysql/flexible-server/how-to-networking-private-link-deny-public-access" ], "compliance": [ { "name": "CIS Microsoft Azure Database Services", "version": "2.0.0", "reference": "6.3", "profile": [ "Level 2" ] } ], "level": "medium", "tags": [], "rule": { "path": "az_mysql_servers", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [ [ "networking.publicNetworkAccess", "eq", "Enabled" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "name": "Name", "location": "location", "resourceGroupName": "Resource Group Name", "networking.publicNetworkAccess": "Public Network Access" }, "expandObject": null }, "table": "default", "decorate": [ { "itemName": "Public Network Access", "itemValue": "enabled", "className": "badge badge-danger badge-xl" } ], "emphasis": [], "actions": { "objectData": { "properties": [ "id", "name", "location", "networking" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "name": "Name", "location": "location", "resourceGroupName": "Resource Group Name", "networking.publicNetworkAccess": "Public Network Access" }, "expandObject": null }, "status": { "keyName": [ "name" ], "message": "Ensure \u0060Public Network Access\u0060 is \u0060Disabled\u0060 for Azure Database for {name}", "defaultMessage": null }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "type" }, "onlyStatus": false } }, "idSuffix": "azure_mysql_public_network_access_enabled", "notes": [], "categories": [], "immutableProperties": [ "name", "id" ], "id": "azure_mysql_003" } |