Skip to main content

📝 Azure VM Scale Set Instance allows public access to MySQL port 🟢

  • Contextual name: 📝 Instance allows public access to MySQL port 🟢
  • ID: /ce/ca/azure/vm-scale-set/instance-allows-unrestricted-traffic-to-mysql
  • Located in: 📁 Azure VM Scale Set

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Logic​

Description​

Open File

Description​

Ensure that Azure VM Scale Set Instances hosting MySQL instances are not configured to allow unrestricted inbound access to port 3306.

Network Security Group (NSG) rules should be reviewed and adjusted to limit traffic to only trusted IP addresses or internal networks, reducing the risk of unauthorized access and exposure to external threats.

Rational​

Unrestricted access to MySQL on port 3306 significantly increases the risk of unauthorized access, brute-force attacks, data exfiltration, and exploitation of SQL injection vulnerabilities. MySQL instances exposed to the internet without appropriate access controls are prime targets for malicious actors, who may attempt to exploit weak authentication mechanisms or known vulnerabilities in the MySQL server. By restricting access to trusted IP addresses or internal networks, only authorized users and systems can interact with the database, safeguarding sensitive data and reducing the attack surface.

Impact​

Restricting access to MySQL may require careful configuration of Security Groups to ensure that legitimate applications and users retain necessary access to the database. Proper planning and testing are essential to maintain service availability while ensuring security.

... see more

Remediation​

Open File

Remediation​

Modify or Remove Insecure NSG Rule​

Review the security rules associated with the relevant Network Security Group (NSG) and determine whether they are required. Take appropriate action based on necessity and scope:

  • If the rule is not required: Remove the rule entirely.

  • If the rule is required but overly permissive: Update the rule to narrowly scope access, restricting the source IP range to only what is strictly necessary.

Azure CLI​

  1. Delete the rule:

    az network nsg rule delete \
      --resource-group {{resource-group-name}} \
      --nsg-name {{nsg-name}} \
      --name {{rule-name}}

  2. Restrict the rule:

    az network nsg rule update \
        --resource-group {{resource-group-name}} \
        --nsg-name {{nsg-name}} \
        --name {{rule-name}} \
        --source-address-prefixes {{trusted-cidr}}

    Replace placeholders with the appropriate values. Use space-separated values for multiple source prefixes or destination ports (e.g., --source-address-prefixes "1.2.3.4/32 5.6.7.8/32").

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 Cloudaware Framework → 💼 Public and Anonymous Access69