Ensure public access is disabled for Azure MySQL Single Server

HIGH

Description

Allowing unrestricted, public access to cloud services could open an application up to external attack. Disallowing this access is typically considered best practice.

Remediation

For MySQL Single Server instances, follow the steps below:

In Azure Console -

  1. Open the Azure Portal and go to MySQL servers.
  2. Choose the SQL server you wish to edit.
  3. Under Settings, select Connection security.
  4. For Deny public network access, set the value to Yes
  5. Select Save.

In Terraform -

  1. In the azurerm_mysql_server resource, set public_network_access_enabled to false.

References:
https://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-networking-public
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mysql_server#public_network_access_enabled

Policy Details

Rule Reference ID: AC_AZURE_0308
CSP: Azure
Remediation Available: Yes
Resource Category: Database
Resource Type: MySQL

Frameworks