Azure APRL and Custom Controls

This check enforces a strict private-only baseline for PostgreSQL Flexible Servers: any enabled public network access, including firewall-restricted access, fails. Well-Architected guidance permits restricting public access when private-only access doesn't fit the workload, so confirm that this baseline is appropriate before remediation. This is a local custom check, not an automated APRL-mapped check or a universal Well-Architected Framework requirement; apply it according to your organization's baseline and workload requirements.

Remediation action:

1. In the Azure portal, navigate to the PostgreSQL Flexible Server.
2. Select Networking under Settings in the left menu.
3. Set Connectivity method to Private access (VNet Integration) or disable public access if a private endpoint is already configured.
4. Configure a private endpoint or VNet integration subnet and click Save.
5. Update application connection strings to use the private hostname and validate connectivity.

Using Azure CLI: az postgres flexible-server update --name <server> --resource-group <rg> --public-access Disabled

Related links

• Private networking concepts for Azure Database for PostgreSQL Flexible Server

%TestResult%