PostgreSQL servers should have public network access disabled
Disable the public network access property so Azure Database for PostgreSQL can only be accessed from a private endpoint.
Disabling the public network access property improves security and ensures your Azure Database for PostgreSQL can only be accessed from a private endpoint.
What this control checks
PostgreSQL servers must have public network access disabled
Common pitfalls
Policy default effect is Audit
The effect parameter has a defaultValue of Audit.
Missing block fails the check
The check inspects public_network_access_enabled with expected value False. The check uses missing_block_result=CheckResult.FAILED.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Public network access should be disabled for PostgreSQL servers" (b52376f7-9612-48a1-81cd-1ffe4b61032c); PowerPipe control azure_compliance.control.postgresql_server_public_network_access_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_68.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 2.2.1.1 Ensure public network access is Disabled
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
postgresql_server_public_network_access_disabled - Checkov Check:
CKV_AZURE_68 - Powerpipe Control:
azure_compliance.control.postgresql_server_public_network_access_disabled - Azure Policy Definition:
b52376f7-9612-48a1-81cd-1ffe4b61032c
Last reviewed: 2026-10-14