Control: 6.3 Ensure no SQL Databases allow ingress 0.0.0.0/0 (ANY IP)
Ensure that no SQL Databases allow ingress from
0.0.0.0/0 (ANY IP).
SQL Server includes a firewall to block access to unauthorized connections. More granular IP addresses can be defined by referencing the range of addresses available from specific datacenters.
By default, for a SQL server, a Firewall exists with
0.0.0.0 allowing access to all the Azure services.
Additionally, a custom rule can be set up with
255.255.255.255 allowing access from ANY IP over the Internet.
In order to reduce the potential attack surface for a SQL server, firewall rules should be defined with more granular IP addresses by referencing the range of addresses available from specific datacenters.
By default, setting Allow access to Azure Services is set to ON allowing access to all Windows Azure IP ranges.
- Login to Azure console, go to SQL servers
- For each SQL server
- Click on
Firewall / Virtual Networksunder security section from side bar
Allow access to Azure servicesto OFF
- Set firewall rules to limit access to only authorized connections
steampipe check azure_compliance.control.cis_v130_6_3
This control uses a named query:sql_database_allow_internet_access