Azure Compliance ControlsAzure Spring Apps
Azure Spring Cloud should use network injection
Azure Spring Cloud instances should use virtual network injection. Network injection isolates Azure Spring Cloud from Internet. It lets customers control inbound and outbound network communications for Azure Spring Cloud.
What this control checks
Azure Spring Cloud instances should be deployed with network injection into a virtual network
Framework mappings
The clauses this control is mapped to in each framework.
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
FedRAMP Moderate Baseline Rev 4
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.12: Monitor and control remote access sessions.
- 3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- 3.1.14 Route remote access via managed access control points
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L2-3.1.12 Monitor and control remote access sessions
- AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- AC.L2-3.1.14 Route remote access via managed access control points
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
spring_cloud_service_network_injection_enabled - Checkov Check:
CKV2_AZURE_23 - Powerpipe Control:
azure_compliance.control.spring_cloud_service_network_injection_enabled - Azure Policy Definition:
af35e2a4-ef96-44e7-a9ae-853dd97032c4
Last reviewed: 2026-10-15