🧠 Azure PostgreSQL Flexible Server Firewall Rules allow access to Azure services - prod.logic.yaml 🟢

• Contextual name: 🧠 prod.logic.yaml 🟢
• ID: /ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/prod.logic.yaml
• Located in: 📝 Azure PostgreSQL Flexible Server Firewall Rules allow access to Azure services 🟢

Flags

• 🟢 Logic test success
• 🟢 Logic with extracts
• 🟢 Logic with test data

Input Type

	Type	API Name	Extracts	Extract Files	Logic Files
🔒	📕 Azure PostgreSQL Server	CA10Z1__CaAzurePostgreSqlServer__c	7	1	9

Uses

• 🔌 Azure PostgreSQL Server - object.extracts.yaml
• 🧪 test-data.json

Test Results 🟢

Generated at: 2025-04-24T23:45:37.391925180Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	test1	✔️ 99	✔️ isDisappeared(CA10Z1__disappearanceTime__c)	✔️ null
🟢	test2	✔️ 399	✔️ extract('caJsonFrom__firewallRules__c').jsonQueryText('length([? properties.startIpAddress == \'0.0.0.0\' && (properties.endIpAddress == \'0.0.0.0\' || properties.endIpAddress == \'255.255.255.255\')])') > number(0.0)	✔️ null
🟢	test3	✔️ 299	✔️ extract('caJsonFrom__firewallRules__c').jsonQueryText('length([? starts_with(name, \'AllowAllAzureServicesAndResourcesWithinAzureIps\')])') > number(0.0)	✔️ null
🟢	test4	✔️ 399	✔️ extract('caJsonFrom__firewallRules__c').jsonQueryText('length([? properties.startIpAddress == \'0.0.0.0\' && (properties.endIpAddress == \'0.0.0.0\' || properties.endIpAddress == \'255.255.255.255\')])') > number(0.0)	✔️ null
🟢	test5	✔️ 500	✔️ otherwise	✔️ null
🟢	test6	✔️ 500	✔️ otherwise	✔️ null
🟢	test7	✔️ 204	✔️ extract('caJsonFrom__firewallRules__c').jsonQueryText('length([? starts_with(name, \'AllowAllAzureServicesAndResourcesWithinAzureIps\')])').isEvaluationFailed()	✔️ TypeError: starts_with() expected argument 1 to be type 2 but received type 7 instead.
🟢	test8	✔️ 500	✔️ otherwise	✔️ null
🟢	test9	✔️ 201	✔️ CA10Z1__firewallRules__c.delegatedTo(CA10Z1__firewallRules__c).isEmpty()	✔️ null
🟢	test10	✔️ 199	✔️ extract('CA10Z1__deploymentMode__c') != 'Flexible'	✔️ null

Generation

	File	MD5
Open	/ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/policy.yaml	36E75FE441963552505613F88F297027
Open	/ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/prod.logic.yaml	115EA6A75B7D2B51C3505AD3291E8168
Open	/types/CA10Z1__CaAzurePostgreSqlServer__c/object.extracts.yaml	08BBA6DB6D72395AA7E05F67B74F9223
Open	/ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/test-data.json	D368F0DE994691DB4F945A6D5306C790

Generate FULL script

java -jar repo-manager.jar policies generate FULL /ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/prod.logic.yaml

Generate DEBUG script

java -jar repo-manager.jar policies generate DEBUG /ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/prod.logic.yaml

Generate CAPTURE_TEST_DATA script

java -jar repo-manager.jar policies generate CAPTURE_TEST_DATA /ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/prod.logic.yaml

Generate TESTS script

java -jar repo-manager.jar policies generate TESTS /ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/prod.logic.yaml

Execute tests

java -jar repo-manager.jar policies test /ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/prod.logic.yaml

Content

Open File

---
inputType: "CA10Z1__CaAzurePostgreSqlServer__c"
testData:
  - file: "test-data.json"
importExtracts:
  - file: "/types/CA10Z1__CaAzurePostgreSqlServer__c/object.extracts.yaml"
conditions:
  - status: "INAPPLICABLE"
    currentStateMessage: "This is not the Flexible Server deployment mode."
    check:
      NOT_EQUAL:
        left:
          EXTRACT: "CA10Z1__deploymentMode__c"
        right:
          TEXT: "Flexible"
  - status: "INCOMPLIANT"
    currentStateMessage: "PostgreSQL Database Server Firewall Rules contain AllowAllWindowsAzureIps rule allowing ingress from 0.0.0.0/0 (ANY IP)."
    remediationMessage: "Consider removing or disabling the overly permissive rule."
    check:
# returns the number of rules which names start with AllowAllAzureServicesAndResourcesWithinAzureIps
      GREATER_THAN:
        left:
          JSON_QUERY_NUMBER:
              arg: 
                EXTRACT: "caJsonFrom__firewallRules__c"
              expression: "length([? starts_with(name, 'AllowAllAzureServicesAndResourcesWithinAzureIps')])"
              undeterminedIf: 
                evaluationError: "The JSON query has failed."
                resultTypeMismatch: "The JSON query did not return number type."
        right:
          NUMBER: 0.0
  - status: "INCOMPLIANT"
    currentStateMessage: "PostgreSQL Database Server Firewall Rules contain a rule allowing ingress from 0.0.0.0/0 (ANY IP)."
    remediationMessage: "Consider removing or disabling the overly permissive rule."
    check:
# number of rules with start and end IPs as 0.0.0.0
      GREATER_THAN:
        left:
          JSON_QUERY_NUMBER:
              arg: 
                EXTRACT: "caJsonFrom__firewallRules__c"
              expression: "length([? properties.startIpAddress == '0.0.0.0' && (properties.endIpAddress == '0.0.0.0' || properties.endIpAddress == '255.255.255.255')])"
              undeterminedIf: 
                evaluationError: "The JSON query has failed."
                resultTypeMismatch: "The JSON query did not return number type."
        right:
          NUMBER: 0.0
  - status: "COMPLIANT"
    currentStateMessage: "PostgreSQL Database Server doesn't have any Firewall Rules."
    check:
      IS_EMPTY:
        arg:
          EXTRACT: "CA10Z1__firewallRules__c"
otherwise:
  status: "COMPLIANT"
  currentStateMessage: "PostgreSQL Database Server Firewall Rules do not have a rule allowing ingress from 0.0.0.0/0 (ANY IP)."