rules/findings/azure/databases/azure_database_mysql/azure-mysql-public-network-access-enabled.json

{
    "args": [],
    "provider": "Azure",
    "serviceType": "Database for MySQL",
    "serviceName": "Databases",
    "displayName": "Ensure `Public Network Access` is `Disabled` for Azure Database for MySQL",
    "description": "Setting public networks to disabled prevents requests from the public internet.",
    "rationale": "Disabling public network access prevents Azure Database for PostgreSQL servers from communicating with the public internet and requires the use of Private endpoints for granular network control and segmentation.",
    "impact": "Disabling 'Public Network Access' forces the requirement of the use of Private Endpoints for network connectivity which will require some additional consideration from a network architecture perspective and will introduce cost based on the inbound/outbound data being processed by the Private Endpoint.",
    "remediation": {
        "text": "Remediate from Azure Portal 1. From Azure Database for PostgreSQL select the database you wish to remediate. 2. In the left column expand > Settings. 3. Select Networking. 4. Uncheck the checkbox under Public Access",
        "code": {
            "powerShell": null,
            "iac": null,
            "terraform": null,
            "other": null
        }
    },
    "recommendation": null,
    "references": [
        "https://learn.microsoft.com/en-us/azure/mysql/flexible-server/how-to-networking-private-link-deny-public-access"
    ],
    "compliance": [
        {
            "name": "CIS Microsoft Azure Database Services",
            "version": "2.0.0",
            "reference": "6.3",
            "profile": [
                "Level 2"
            ]
        }
    ],
    "level": "medium",
    "tags": [],
    "rule": {
        "path": "az_mysql_servers",
        "subPath": null,
        "selectCondition": {},
        "query": [
            {
                "filter": [
                    {
                        "conditions": [
                            [
                                "networking.publicNetworkAccess",
                                "eq",
                                "Enabled"
                            ]
                        ]
                    }
                ]
            }
        ],
        "shouldExist": null,
        "returnObject": null,
        "removeIfNotExists": null
    },
    "output": {
        "html": {
            "data": {
                "properties": {
                    "name": "Name",
                    "location": "location",
                    "resourceGroupName": "Resource Group Name",
                    "networking.publicNetworkAccess": "Public Network Access"
                },
                "expandObject": null
            },
            "table": "default",
            "decorate": [
                {
                    "itemName": "Public Network Access",
                    "itemValue": "enabled",
                    "className": "badge badge-danger badge-xl"
                }
            ],
            "emphasis": [],
            "actions": {
                "objectData": {
                    "properties": [
                        "id",
                        "name",
                        "location",
                        "networking"
                    ],
                    "expandObject": null,
                    "limit": null
                },
                "showGoToButton": "True",
                "showModalButton": "True",
                "directLink": null
            }
        },
        "text": {
            "data": {
                "properties": {
                    "name": "Name",
                    "location": "location",
                    "resourceGroupName": "Resource Group Name",
                    "networking.publicNetworkAccess": "Public Network Access"
                },
                "expandObject": null
            },
            "status": {
                "keyName": ["name"],
                "message": "Ensure `Public Network Access` is `Disabled` for Azure Database for {name}",
                "defaultMessage": null
            },
            "properties": {
                "resourceName": "name",
                "resourceId": "id",
                "resourceType": "type"
            },
            "onlyStatus": false
        }
    },
    "idSuffix": "azure_mysql_public_network_access_enabled",
    "notes": [],
    "categories": [],
    "immutable_properties": [
        "name",
        "id"
    ],
    "id": "azure_mysql_003"
}