Network security groups should limit inbound UDP port 53 access from the internet
Network security group provide stateful filtering of inbound/outbound network traffic to Azure resources. It is recommended that no network security group allows unrestricted inbound access to UDP port 53.
Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
What this control checks
Trivy check AZU-0047 says a security group rule should not allow unrestricted ingress from any IP address. Its Terraform example uses azurerm_network_security_rule with direction set to Inbound, access set to Allow and a restrictive destination_address_prefix of 10.0.0.0/16.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.network_security_group_restrict_inbound_udp_port_53.
Scans of the Terraform code that flag the same setting before deployment: Trivy check AZU-0047.
Related controls
- Network security groups should limit inbound TCP port 53 access from the internet
- Subnets should have a network security group configured
- Network security groups should have flow logs captured and sent to Log Analytics
- Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group
- Azure subscriptions should have at least one Azure Bastion host
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_udp_port_53 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_udp_port_53 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13