🧠 Azure PostgreSQL Flexible Server Firewall Rules allow access to Azure services - prod.logic.yaml🟢

• Contextual name: 🧠 prod.logic.yaml🟢
• ID: /ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/prod.logic.yaml
• Tags:
  • 🟢 Logic test success
  • 🟢 Logic with extracts
  • 🟢 Logic with test data

Uses

• 📗 Azure PostgreSQL Server
• 🔌 Azure PostgreSQL Server - object.extracts.yaml
• 🧪 test-data.json

Test Results 🟢

Generated at: 2026-02-10T22:33:32.715575805Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	test1	✔️ 99	✔️ isDisappeared(CA10Z1__disappearanceTime__c)	✔️ null
🟢	test2	✔️ 399	✔️ extract('caJsonFrom__firewallRules__c').jsonQueryText('length([? properties.startIpAddress == \'0.0.0.0\' && (properties.endIpAddress == \'0.0.0.0\' || properties.endIpAddress == \'255.255.255.255\')])') > number(0.0)	✔️ null
🟢	test3	✔️ 299	✔️ extract('caJsonFrom__firewallRules__c').jsonQueryText('length([? starts_with(name, \'AllowAllAzureServicesAndResourcesWithinAzureIps\')])') > number(0.0)	✔️ null
🟢	test4	✔️ 399	✔️ extract('caJsonFrom__firewallRules__c').jsonQueryText('length([? properties.startIpAddress == \'0.0.0.0\' && (properties.endIpAddress == \'0.0.0.0\' || properties.endIpAddress == \'255.255.255.255\')])') > number(0.0)	✔️ null
🟢	test5	✔️ 500	✔️ otherwise	✔️ null
🟢	test6	✔️ 500	✔️ otherwise	✔️ null
🟢	test7	✔️ 204	✔️ extract('caJsonFrom__firewallRules__c').jsonQueryText('length([? starts_with(name, \'AllowAllAzureServicesAndResourcesWithinAzureIps\')])').isEvaluationFailed()	✔️ TypeError: starts_with() expected argument 1 to be type 2 but received type 7 instead.
🟢	test8	✔️ 500	✔️ otherwise	✔️ null
🟢	test9	✔️ 201	✔️ CA10Z1__firewallRules__c.delegatedTo(CA10Z1__firewallRules__c).isEmpty()	✔️ null
🟢	test10	✔️ 199	✔️ extract('CA10Z1__deploymentMode__c') != 'Flexible'	✔️ null

Generation Bundle

	File	MD5
Open	/ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/policy.yaml	36E75FE441963552505613F88F297027
Open	/ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/prod.logic.yaml	346B846366A7B1DE85EB1883AAB784C2
Open	/ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/test-data.json	D368F0DE994691DB4F945A6D5306C790
Open	/types/CA10Z1__CaAzurePostgreSqlServer__c/object.extracts.yaml	57EE11B2A1C370B47B2D4FE4AF22C8D0

Available Commands

repo-manager policies generate FULL /ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/azure/postgresql-database/disable-flexible-server-allows-access-to-azure-services/prod.logic.yaml

Content

Open File

---
inputType: "CA10Z1__CaAzurePostgreSqlServer__c"
testData:
  - file: "test-data.json"
importExtracts:
  - file: "/types/CA10Z1__CaAzurePostgreSqlServer__c/object.extracts.yaml"
conditions:
  - status: "INAPPLICABLE"
    currentStateMessage: "This is not the flexible server deployment mode."
    check:
      NOT_EQUAL:
        left:
          EXTRACT: "CA10Z1__deploymentMode__c"
        right:
          TEXT: "Flexible"
  - status: "INCOMPLIANT"
    currentStateMessage: "PostgreSQL server firewall rules allow ingress from 0.0.0.0/0 (ANY IP) via the AllowAllWindowsAzureIps rule."
    remediationMessage: "Remove or disable the overly permissive rule."
    check:
# returns the number of rules which names start with AllowAllAzureServicesAndResourcesWithinAzureIps
      GREATER_THAN:
        left:
          JSON_QUERY_NUMBER:
              arg: 
                EXTRACT: "caJsonFrom__firewallRules__c"
              expression: "length([? starts_with(name, 'AllowAllAzureServicesAndResourcesWithinAzureIps')])"
              undeterminedIf: 
                evaluationError: "The JSON query has failed."
                resultTypeMismatch: "The JSON query did not return number type."
        right:
          NUMBER: 0.0
  - status: "INCOMPLIANT"
    currentStateMessage: "PostgreSQL server firewall rules allow ingress from 0.0.0.0/0 (ANY IP)."
    remediationMessage: "Remove or disable the overly permissive rule."
    check:
# number of rules with start and end IPs as 0.0.0.0
      GREATER_THAN:
        left:
          JSON_QUERY_NUMBER:
              arg: 
                EXTRACT: "caJsonFrom__firewallRules__c"
              expression: "length([? properties.startIpAddress == '0.0.0.0' && (properties.endIpAddress == '0.0.0.0' || properties.endIpAddress == '255.255.255.255')])"
              undeterminedIf: 
                evaluationError: "The JSON query has failed."
                resultTypeMismatch: "The JSON query did not return number type."
        right:
          NUMBER: 0.0
  - status: "COMPLIANT"
    currentStateMessage: "PostgreSQL server firewall rules are not defined."
    check:
      IS_EMPTY:
        arg:
          EXTRACT: "CA10Z1__firewallRules__c"
otherwise:
  status: "COMPLIANT"
  currentStateMessage: "PostgreSQL server firewall rules do not allow ingress from 0.0.0.0/0 (ANY IP)."