Other Articles
- SQL Database – Enable Database Encryption
- SQL Server – Enable SQL Defender
- SQL Database – Monitor CPU Utilization
- SQL Database – Monitor IO Utilization
- SQL Database – Monitor Memory Utilization
- SQL Database – Protect From Direct Internet Traffic
- Storage Account – Enable Storage Encryption
- Storage Account – Disable Blob Public Access
- Storage Account – Disable Cross-Tenant Replication
- Storage Account – Disable Public Network Access
- Storage Account – Enable Microsoft Defender
- Storage Account – Enable Secure Transfer
- Storage Account – Enforce Minimum TLS Version
- Storage Account – Enforce Network Access Rule
- Storage Account – Enforce Private Endpoint Access
- User – Enable Azure MFA
- App Service – Disable Remote Debugging
- App Service – Enable Defender
- App Service – Enable Entra ID Registration
- App Service – Enable HTTP2
- App Service – Enforce Latest TLS Version
- App Service – Enforce Secure FTPS State
- App Service – Monitor Server Errors
- App Service – Redirect HTTP to HTTPS
- Cosmos DB – Enable Backup
- Cosmos DB – Enable Microsoft Defender
- Cosmos DB – Monitor Latency
- Cosmos DB – Ensure Private Connectivity
- Cosmos DB for PostgreSQL – Monitor CPU Utilization
- Cosmos DB for PostgreSQL – Monitor IO Utilization
- Cosmos DB for PostgreSQL – Monitor Memory Utilization
- Cosmos DB for PostgreSQL – Protect From Direct Internet Traffic
- Cosmos DB – Protect From Direct Internet Traffic
- Cosmos DB – Restrict Firewall Network Access
- Virtual Machine – Enable Defender
- Virtual Machine – Protect From Direct Internet Traffic
- Key Vault – Enable Defender
- Key Vault – Ensure Vault Recoverable
- Key Vault – Require Private Endpoint Access
- MySQL Flexible Server – Enable Audit Log Events Connection
- MySQL Flexible Server – Enable Audit Logs
- MySQL Flexible Server – Enforce Minimum TLS Version
- PostgreSQL Flexible Server – Configure Log File Retention
- PostgreSQL Flexible Server – Enable Connection Throttling
- PostgreSQL Flexible Server – Enable Disconnection Logging
- PostgreSQL Flexible Server – Enable Log Checkpoints
- Network Security Group – Ensure Flow Logs Captured
- General – Enable Auto Provisioning Log Analytics
- General – Enable Security Notifications
- General – Set Additional Email Address
PostgreSQL Flexible Server – Enable Connection Logging
This check ensures that connection logging is enabled for Azure PostgreSQL Flexible Servers by setting the server parameter log_connections to ON. Enabling connection logging helps monitor client access attempts and supports security monitoring and auditing.
Check Details
- Resource: Azure PostgreSQL Flexible Server
- Check: Ensure log_connections Parameter Is Enabled
- Risk: If connection logging is disabled, client connection attempts may not be recorded, reducing visibility into authentication events and potentially hindering investigation of unauthorized access or suspicious activity.
Remediation via Azure Portal
-
Log in to the Azure Portal.
-
Navigate to Azure Database for PostgreSQL Flexible Servers and select the affected server.
-
In the left-hand menu, select Server parameters under Settings.
- Search for the parameter log_connections.
-
Ensure the value of log_connections is set to ON.
- Click Save to apply the changes.
Remediation via Azure CLI
-
Open Azure Cloud Shell or a local terminal with Azure CLI installed.
-
Check the current value of the log_connections parameter:
az postgres flexible-server parameter show \ --resource-group <resource-group> \ --server-name <postgres-server-name> \ --name log_connections
-
Enable connection logging by setting log_connections to ON:
az postgres flexible-server parameter set \ --resource-group <resource-group> \ --server-name <postgres-server-name> \ --name log_connections \ --value on
-
Verify that the parameter is enabled:
az postgres flexible-server parameter show \ --resource-group <resource-group> \ --server-name <postgres-server-name> \ --name log_connections \ --query value
Replace <resource-group> and
<postgres-server-name> with your actual values.
The output should confirm that the parameter value is set to
on.