PostgreSQL Database ingress traffic should be restricted to specified IP addresses
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Description
Ensure that no PostgreSQL Databases allow ingress from 0.0.0.0/0 (ANY IP).
Rationale
PostgreSQL Server includes a firewall to block access to unauthorized connections. More granular IP addresses can be defined by referencing the range of addresses available from specific datacenters.
Impact
Disabling Allow access to Azure Services will break all connections to PostgreSQL server and Hosted Databases unless custom IP specific rules are not added in Firewall Policy.
From the console
- Go to PostgreSQL servers
- For each PostgreSQL server, click on Firewall / Virtual Networks
- Set Allow access to Azure services to
OFF - Set firewall rules to limit access to only authorized connections
Using PowerShell
Disable default firewall rule “Allow access to Azure services”:
Remove-AzPostgreSqlFirewallRule -Name "AllowAllWindowsAzureIps" -ResourceGroupName <resource group name> -ServerName <server name>
Remove custom firewall rule:
Remove-AzPostgreSqlFirewallRule -Name <name> -ResourceGroupName <resource group name> -ServerName <server name>
Set the appropriate firewall rules:
New-AzPostgreSqlFirewallRule -Name "<rule name>" -ResourceGroupName "<resource group name>" -ServerName "<server name>" -EndIPAddress "<IP Address other than 0.0.0.0>" -StartIPAddress "<IP Address other than 0.0.0.0 or 255.255.255.255>"
References
- https://docs.microsoft.com/en-us/azure/postgresql/concepts-firewall-rules
