🧠 Azure Network Security Group allows unrestricted database traffic - prod.logic.yaml🟢

Contextual name: 🧠 prod.logic.yaml🟢
ID: /ce/ca/azure/virtual-network/security-group-allows-unrestricted-database-traffic/prod.logic.yaml
Tags:
- 🟢 Logic test success
- 🟢 Logic with extracts
- 🟢 Logic with test data

Uses

📗 Azure Network Security Group
🔌 Azure Network Security Group Rule - object.extracts.yaml
🧪 test-data.json

Test Results 🟢

Generated at: 2026-11-14T12:03:55.999141494Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	database-port-1433	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	database-port-1434	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	database-port-1521	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	database-port-3306	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	database-port-5432	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	database-port-6379	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	database-port-27017	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	database-wildcard	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	database-range	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	database-private	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	database-ipv6	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	database-prefix-list	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	database-deny	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	database-outbound	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	database-unrelated	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	database-missing-protocol	✔️ `299`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(UNDETERMINED)`	✔️ `null`
🟢	database-missing-source	✔️ `299`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(UNDETERMINED)`	✔️ `null`
🟢	database-empty	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	database-mixed	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	database-unknown-access	✔️ `299`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(UNDETERMINED)`	✔️ `null`
🟢	database-unknown-direction	✔️ `299`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(UNDETERMINED)`	✔️ `null`
🟢	database-protocol-udp	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	database-protocol-unknown	✔️ `299`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(UNDETERMINED)`	✔️ `null`
🟢	database-protocol-icmp	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	database-protocol-esp	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	database-protocol-ah	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	database-protocol-violation-unknown	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	database-protocol-excluded-unknown	✔️ `299`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(UNDETERMINED)`	✔️ `null`

Generation Bundle

	File	MD5
Open	`/ce/ca/azure/virtual-network/security-group-allows-unrestricted-database-traffic/policy.yaml`	`878C2303CC35B5AE0DAF0384ADF98BF7`
Open	`/ce/ca/azure/virtual-network/security-group-allows-unrestricted-database-traffic/prod.logic.yaml`	`FF92F353920CFB55707050B6E543294F`
Open	`/ce/ca/azure/virtual-network/security-group-allows-unrestricted-database-traffic/test-data.json`	`40DAE485CDA6F4E6A1A96D2F5E6C3AE2`
Open	`/types/CA10__CaAzureNetworkSecurityGroupRule__c/object.extracts.yaml`	`A60C817EFBC8F066D6D082898E8597BC`

Available Commands

repo-manager policies generate FULL /ce/ca/azure/virtual-network/security-group-allows-unrestricted-database-traffic/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/azure/virtual-network/security-group-allows-unrestricted-database-traffic/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/azure/virtual-network/security-group-allows-unrestricted-database-traffic/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/azure/virtual-network/security-group-allows-unrestricted-database-traffic/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/azure/virtual-network/security-group-allows-unrestricted-database-traffic/prod.logic.yaml

Content

Open File

---
inputType: CA10__CaAzureNetworkSecurityGroup__c
testData:
- file: test-data.json
conditions:
- status: INCOMPLIANT
  currentStateMessage: The network security group exposes database ports to the internet.
  remediationMessage: Remove or restrict public database ingress rules.
  check:
    RELATED_LIST_HAS:
      relationshipName: CA10__Azure_Network_Security_Group_Rules__r
      status: INCOMPLIANT
- status: UNDETERMINED
  currentStateMessage: Some network security group rules cannot be assessed.
  check:
    RELATED_LIST_HAS:
      relationshipName: CA10__Azure_Network_Security_Group_Rules__r
      status: UNDETERMINED
otherwise:
  status: COMPLIANT
  currentStateMessage: No current assessed rule exposes database ports to the internet.
relatedLists:
- relationshipName: CA10__Azure_Network_Security_Group_Rules__r
  importExtracts:
  - file: /types/CA10__CaAzureNetworkSecurityGroupRule__c/object.extracts.yaml
  conditions:
  - status: INAPPLICABLE
    currentStateMessage: This rule denies traffic.
    check:
      IS_EQUAL:
        left:
          EXTRACT: CA10__access__c
        right:
          TEXT: Deny
  - status: INAPPLICABLE
    currentStateMessage: This is an outbound rule.
    check:
      IS_EQUAL:
        left:
          EXTRACT: CA10__direction__c
        right:
          TEXT: Outbound
  - status: UNDETERMINED
    currentStateMessage: The rule access value is unexpected.
    check:
      NOT:
        arg:
          IS_EQUAL:
            left:
              EXTRACT: CA10__access__c
            right:
              TEXT: Allow
  - status: UNDETERMINED
    currentStateMessage: The rule direction is unexpected.
    check:
      NOT:
        arg:
          IS_EQUAL:
            left:
              EXTRACT: CA10__direction__c
            right:
              TEXT: Inbound
  - status: INAPPLICABLE
    currentStateMessage: The recognized protocol does not carry the assessed traffic.
    check:
      CONTAINS:
        arg:
          SET:
            itemType: TEXT
            items:
            - Icmp
            - Esp
            - Ah
        search:
          EXTRACT: CA10__protocol__c
  - status: UNDETERMINED
    currentStateMessage: The rule protocol is unsupported.
    check:
      NOT:
        arg:
          CONTAINS:
            arg:
              SET:
                itemType: TEXT
                items:
                - Tcp
                - Udp
                - '*'
            search:
              EXTRACT: CA10__protocol__c
  - status: UNDETERMINED
    currentStateMessage: The rule has no collected source range.
    check:
      AND:
        args:
        - IS_EMPTY:
            arg:
              EXTRACT: CA10__sourceAddressPrefix__c
        - IS_EMPTY:
            arg:
              EXTRACT: CA10__sourceAddressPrefixes__c
  - status: INAPPLICABLE
    currentStateMessage: The rule does not permit traffic from all internet addresses.
    check:
      NOT:
        arg:
          OR:
            args:
            - CONTAINS:
                arg:
                  SET:
                    itemType: TEXT
                    items:
                    - '*'
                    - Internet
                    - Any
                    - 0.0.0.0/0
                    - ::/0
                    - 0.0.0.0
                search:
                  EXTRACT: CA10__sourceAddressPrefix__c
            - CONTAINS:
                arg:
                  EXTRACT: CA10__sourceAddressPrefixes__c
                search:
                  TEXT: /0
  - status: INCOMPLIANT
    currentStateMessage: The rule exposes database ports to the internet.
    remediationMessage: Restrict the source addresses or remove the exposed database ports.
    check:
      OR:
        args:
        - IS_EQUAL:
            left:
              EXTRACT: CA10__destinationPortRange__c
            right:
              TEXT: '*'
        - CONTAINS:
            arg:
              SET:
                itemType: TEXT
                items:
                - '1433'
                - '1434'
                - '1521'
                - '3306'
                - '5432'
                - '6379'
                - '27017'
            search:
              EXTRACT: CA10__destinationPortRange__c
        - OR:
            args:
            - AND:
                args:
                - LESS_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortFrom__c
                    right:
                      NUMBER: 1433
                - GREATER_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortTo__c
                    right:
                      NUMBER: 1433
            - AND:
                args:
                - LESS_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortFrom__c
                    right:
                      NUMBER: 1434
                - GREATER_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortTo__c
                    right:
                      NUMBER: 1434
            - AND:
                args:
                - LESS_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortFrom__c
                    right:
                      NUMBER: 1521
                - GREATER_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortTo__c
                    right:
                      NUMBER: 1521
            - AND:
                args:
                - LESS_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortFrom__c
                    right:
                      NUMBER: 3306
                - GREATER_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortTo__c
                    right:
                      NUMBER: 3306
            - AND:
                args:
                - LESS_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortFrom__c
                    right:
                      NUMBER: 5432
                - GREATER_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortTo__c
                    right:
                      NUMBER: 5432
            - AND:
                args:
                - LESS_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortFrom__c
                    right:
                      NUMBER: 6379
                - GREATER_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortTo__c
                    right:
                      NUMBER: 6379
            - AND:
                args:
                - LESS_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortFrom__c
                    right:
                      NUMBER: 27017
                - GREATER_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortTo__c
                    right:
                      NUMBER: 27017
  - status: UNDETERMINED
    currentStateMessage: The collected destination port range cannot be assessed.
    check:
      OR:
        args:
        - IS_EMPTY:
            arg:
              EXTRACT: CA10__destinationPortFrom__c
        - IS_EMPTY:
            arg:
              EXTRACT: CA10__destinationPortTo__c
  otherwise:
    status: INAPPLICABLE
    currentStateMessage: This rule does not expose the assessed database ports.

Uses​

Test Results 🟢​

Generation Bundle​

Available Commands​

Content​

Uses

Test Results 🟢

Generation Bundle

Available Commands

Content