Azure Spring Cloud should use network injection
Azure Spring Cloud instances should use virtual network injection. Network injection isolates Azure Spring Cloud from Internet. It lets customers control inbound and outbound network communications for Azure Spring Cloud.
Azure Spring Cloud instances should use virtual network injection to isolate Azure Spring Cloud from Internet.
What this control checks
Azure Spring Cloud instances should be deployed with network injection into a virtual network
Common pitfalls
Powerpipe skips when sku_tier is not Standard
Powerpipe returns skip when sku_tier is not Standard.
Checkov rejects sku_name equal to B0
Checkov CKV2_AZURE_23 requires sku_name not equal to B0 (ignoring case).
Subnet ID must exist in network block
Checkov CKV2_AZURE_23 requires network.service_runtime_subnet_id to exist.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Spring Cloud should use network injection" (af35e2a4-ef96-44e7-a9ae-853dd97032c4); PowerPipe control azure_compliance.control.spring_cloud_service_network_injection_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_AZURE_23.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access) and AC-17(1) (Monitoring and Control).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access) and AC-17(1) (Automated Monitoring/Control).
Framework mappings
The clauses this control is mapped to in each framework.
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
FedRAMP Moderate Baseline Rev 4
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.12: Monitor and control remote access sessions.
- 3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- 3.1.14 Route remote access via managed access control points
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L2-3.1.12 Monitor and control remote access sessions
- AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- AC.L2-3.1.14 Route remote access via managed access control points
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
spring_cloud_service_network_injection_enabled - Checkov Check:
CKV2_AZURE_23 - Powerpipe Control:
azure_compliance.control.spring_cloud_service_network_injection_enabled - Azure Policy Definition:
af35e2a4-ef96-44e7-a9ae-853dd97032c4
Last reviewed: 2026-10-15