No Public Ingress | Vulnerability Database

A security group rule should not allow unrestricted ingress from any IP address.

Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Set a more restrictive cidr range

1
2
3
4
5


resource "azurerm_network_security_rule" "good_example" {
  direction                  = "Inbound"
  destination_address_prefix = "10.0.0.0/16"
  access                     = "Allow"
}

1
2
3
4
5
6
7
8


resource "azurerm_network_security_rule" "allow_lb_prober" {
  direction               = "Inbound"
  access                  = "Allow"
  protocol                = "Tcp" # Probes are always TCP
  source_port_range       = "*"
  destination_port_ranges = "443"
  source_address_prefix   = "168.63.129.16" // single public IP (Azure well known)
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule