SQL Server should use private endpoints

High Azure General sql-private-endpoint

Applies to

Microsoft.Sql/servers

What CGPulse checks

A resource passes this rule when privateEndpointConnections.hasConnections must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Add a private endpoint to route traffic privately and eliminate internet exposure. In Azure Portal: SQL Server > Networking > Private endpoint connections > Add. See: https://learn.microsoft.com/en-us/azure/azure-sql/database/private-endpoint-overview

CLI

az network private-endpoint create -g "{rg}" -n "{name}-pe" --vnet-name var.vnet_name --subnet "<subnet-name>" --private-connection-resource-id "{id}" --group-id "sqlServer" --connection-name "{name}-plsc"

Terraform

resource "azurerm_private_endpoint" "sql" {
  name                = "{name}-pe"
  resource_group_name = "{rg}"
  location            = var.location
  subnet_id           = var.subnet_id
  private_service_connection {
    name                           = "{name}-plsc"
    private_connection_resource_id = "{id}"
    subresource_names              = ["sqlServer"]
    is_manual_connection           = false
  }
}

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan