Azure Compliance ControlsAzure Database for PostgreSQL
PostgreSQL flexible servers should have 'Allow public access from any Azure service within Azure to this server' disabled
Prowler check postgresql_flexible_server_allow_access_services_disabled looks at the Azure Database for PostgreSQL Flexible Server firewall. It should not include the rule that allows connections from any Azure service, start_ip=0.0.0.0 and end_ip=0.0.0.0.
What this control checks
Fails if the firewall has the 0.0.0.0 to 0.0.0.0 rule allowing connections from any Azure service.
Framework mappings
The clauses this control is mapped to in each framework.
- A.8.3 Information access restriction
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 4.3.7 Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled
- 4.3.7 Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled
- 5.2.5 Ensure 'Allow public access from any Azure service within Azure to this server' for PostgreSQL flexible server is disabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
postgres_flexible_server_allow_access_to_azure_services_disabled - Checkov Check:
CKV2_AZURE_26 - Powerpipe Control:
azure_compliance.control.postgres_flexible_server_allow_access_to_azure_services_disabled - Prowler Check:
postgresql_flexible_server_allow_access_services_disabled
Last reviewed: 2026-10-14