Azure Compliance ControlsAzure Service Bus
Service Bus namespaces should not allow overly permissive network access
Checks Azure Service Bus namespaces for network access settings that permit broad connectivity. Each namespace is evaluated, and those whose network access configuration is overly permissive, rather than restricted to specific sources, are reported as failing.
What this control checks
Azure Policy cbd11fd3-3002-4907-b6c8-579f0e700e13 flags a Microsoft.ServiceBus/namespaces resource when publicNetworkAccess is not equal to Disabled. Checkov CKV_AZURE_204 inspects public_network_access_enabled on azurerm_servicebus_namespace and expects the value False.
Framework mappings
The clauses this control is mapped to in each framework.
- 2.2.1.2 Ensure Network Access Rules are set to Deny-by-default
Related controls
- Storage accounts should use virtual network rules to restrict network access
- Key vaults should have public network access disabled
- PostgreSQL servers should have public network access disabled
- Storage accounts should have network access restrictions configured
- Recovery Services vaults should use private link
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
servicebus_namespace_no_overly_permissive_network_access - Checkov Check:
CKV_AZURE_204 - Powerpipe Control:
azure_compliance.control.servicebus_namespace_no_overly_permissive_network_access - Azure Policy Definition:
cbd11fd3-3002-4907-b6c8-579f0e700e13
Last reviewed: 2026-10-15