PostgreSQL flexible servers should have 'Allow public access from any Azure service within Azure to this server' disabled
Prowler check postgresql_flexible_server_allow_access_services_disabled looks at the Azure Database for PostgreSQL Flexible Server firewall. It should not include the rule that allows connections from any Azure service, start_ip=0.0.0.0 and end_ip=0.0.0.0.
Allowing all Azure services erodes network isolation, permitting unsolicited connections from other subscriptions and tenants. This enables credential brute force and unauthorized access paths, risking data confidentiality and integrity, and increasing the chance of service disruption (availability).
What this control checks
Fails if the firewall has the 0.0.0.0 to 0.0.0.0 rule allowing connections from any Azure service.
Audit evidence
Evidence that deployed resources meet this control: Prowler check postgresql_flexible_server_allow_access_services_disabled (prowler azure --checks postgresql_flexible_server_allow_access_services_disabled); PowerPipe control azure_compliance.control.postgres_flexible_server_allow_access_to_azure_services_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_AZURE_26.
Framework-specific interpretation
ISO/IEC 27001:2022: Mapped to A.8.3 (Information Access Restriction).
Framework mappings
The clauses this control is mapped to in each framework.
- A.8.3 Information access restriction
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 4.3.7 Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled
- 4.3.7 Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled
- 5.2.5 Ensure 'Allow public access from any Azure service within Azure to this server' for PostgreSQL flexible server is disabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
postgres_flexible_server_allow_access_to_azure_services_disabled - Checkov Check:
CKV2_AZURE_26 - Powerpipe Control:
azure_compliance.control.postgres_flexible_server_allow_access_to_azure_services_disabled - Prowler Check:
postgresql_flexible_server_allow_access_services_disabled
Last reviewed: 2026-10-14