NSG should not allow HTTP from Internet

High Azure General nsg-nsg-allow-http-from

Applies to

Microsoft.Network/networkSecurityGroups

What CGPulse checks

A resource passes this rule when allowsHttpFromInternet must equal false. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Remove or restrict inbound HTTP (port 80) rules from Any/Internet and use HTTPS instead. In Azure Portal: NSG > Inbound security rules > modify HTTP rules. See: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

Careful: Removing HTTP rules may break web access. Ensure HTTPS redirect is configured

CLI

az network nsg rule list --nsg-name "{name}" -g "{rg}" -o table

Terraform

# Remove or restrict NSG rules that allow HTTP (port 80) from Internet
resource "azurerm_network_security_rule" "deny_http" {
  name                        = "deny-http-from-internet"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Deny"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "80"
  source_address_prefix       = "Internet"
  destination_address_prefix  = "*"
  resource_group_name         = "{rg}"
  network_security_group_name = "{name}"
}

Compliance frameworks

Cloud Security BaselineNS-1

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan