Azure Compliance ControlsAzure Virtual Network
Network security groups should limit inbound UDP port 53 access from the internet
Network security group provide stateful filtering of inbound/outbound network traffic to Azure resources. It is recommended that no network security group allows unrestricted inbound access to UDP port 53.
What this control checks
Trivy check AZU-0047 says a security group rule should not allow unrestricted ingress from any IP address. Its Terraform example uses azurerm_network_security_rule with direction set to Inbound, access set to Allow and a restrictive destination_address_prefix of 10.0.0.0/16.
Related controls
- Network security groups should limit inbound TCP port 53 access from the internet
- Subnets should have a network security group configured
- Network security groups should have flow logs captured and sent to Log Analytics
- Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group
- Azure subscriptions should have at least one Azure Bastion host
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_udp_port_53 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_udp_port_53 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13