Network security groups should limit inbound TCP port 5900 access from the internet
The check relies on Trivy rule `AZU-0047`. That rule flags rules that allow unrestricted ingress from any IP address, so a finding means a rule exposes its target to traffic from every source instead of a limited set of addresses.
What this control checks
Trivy check AZU-0047 looks at azurerm_network_security_rule and fails a rule that allows unrestricted ingress from any IP address. Trivy AZU-0047 passes when a more restrictive cidr range is set, for example a destination_address_prefix of 10.0.0.0/16 with direction set to Inbound. Powerpipe check network_security_group_restrict_inbound_tcp_port_5900 is titled "Network security groups should restrict inbound TCP port 5900 access from internet".
Related controls
- SQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)
- Storage accounts should have the default network access rule set to deny
- Storage accounts should prohibit public access
- Container registries should have public network access disabled
- MariaDB servers should have public network access disabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_tcp_port_5900 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_tcp_port_5900 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13