Azure Compliance ControlsAzure Database for MariaDB
MariaDB servers should have public network access disabled
Disable the public network access property so Azure Database for MariaDB can only be accessed from a private endpoint. This configuration denies all logins that match IP or virtual network-based firewall rules.
What this control checks
MariaDB servers must have publicNetworkAccess set to Disabled
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 2.2.1.1 Ensure public network access is Disabled
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
- PostgreSQL servers should have private endpoints enabled
- PostgreSQL flexible servers should have 'Allow public access from any Azure service within Azure to this server' disabled
- Azure Cognitive Search services should use private link
- Container registries should use private link
- Azure Service Bus namespaces should use private link
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
mariadb_server_public_network_access_disabled - Checkov Check:
CKV_AZURE_48 - Powerpipe Control:
azure_compliance.control.mariadb_server_public_network_access_disabled - Azure Policy Definition:
fdccbe47-f3e3-4213-ad5d-ea459b2fa077 - KICS Query:
7f0a8696-7159-4337-ad0d-8a3ab4a78195 - Trivy Check:
AZU-0022
Last reviewed: 2026-10-13