[RULE] AZ-DB-004: SQL Server Firewall Allows All Azure Services

[TFT444]

Objective

Add a new scanner rule to detect Azure SQL Servers where the firewall rule "Allow access to Azure services" is enabled, exposing the database to all Azure-hosted resources.

Background

Enabling "Allow access to Azure services" opens the SQL Server firewall to any resource hosted on Azure — including resources from other tenants and customers. This is a broad and often misunderstood setting that significantly increases the attack surface.

Real-World Breach Scenario

In multiple Azure data exposure incidents, attackers spun up Azure VMs in their own subscriptions and connected directly to victim SQL Servers that had this setting enabled. The firewall rule treated all Azure IPs as trusted regardless of tenant.

Compliance Mapping

• CIS Azure Benchmark: 6.3
• NIST CSF: PR.AC-3
• ISO 27001: A.13.1.3
• SOC 2: CC6.6

Deliverables

• scanner/rules/az_db_004.py — scan() function using Azure SDK
• playbooks/cli/fix_az_db_004.sh — disable allow all Azure services firewall rule
• compliance/frameworks/cis_azure_benchmark.json — add AZ-DB-004 entry
• compliance/frameworks/nist_csf.json — add AZ-DB-004 entry
• compliance/frameworks/iso27001.json — add AZ-DB-004 entry
• compliance/frameworks/soc2.json — add AZ-DB-004 entry

Severity

HIGH

Category

Database

[aav-wh]

my github is aav-wh

[TFT444]

No worries, that issue is for you; I will assign it to you now. Go on, bro; if you need any help ask me.

[aav-wh]

Resolved by PR #70 — AZ-DB-004 merged