Azure Compliance ControlsAzure Virtual Network
Network security groups should have HTTP(S) access from the internet evaluated and restricted
Trivy AZU-0047 states that a security group rule should not allow unrestricted ingress from any IP address. It says you should restrict access to IP addresses or ranges that are explicitly required where possible.
What this control checks
A security group rule should not allow unrestricted ingress from any IP address.
Framework mappings
The clauses this control is mapped to in each framework.
- 6.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted
- 6.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_https_access_restricted - Powerpipe Control:
azure_compliance.control.network_security_group_https_access_restricted - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13