Network security groups should limit inbound UDP port 445 access from the internet
Uses Trivy `AZU-0047` to flag Azure network security group rules that allow unrestricted ingress from any IP address. A rule is reported when its source is open to all addresses, so traffic from any origin is permitted by that rule.
Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
What this control checks
Fails if a security group rule allows unrestricted ingress from any IP address.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.network_security_group_restrict_inbound_udp_port_445.
Scans of the Terraform code that flag the same setting before deployment: Trivy check AZU-0047.
Related controls
- Network security groups should limit inbound UDP port 137 access from the internet
- Network security groups should limit inbound TCP port 21 access from the internet
- Network security groups should limit inbound TCP port 5432 access from the internet
- Network security groups should limit outbound access from the internet
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_udp_port_445 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_udp_port_445 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13