Cis Azure Database 6.5

6.5 Ensure server parameter 'connection_throttle.enable' is set to 'ON' for PostgreSQL server (Automated)

Profile Applicability

• Level 1

Description

Enable connection_throttling on PostgreSQL flexible servers.

Rationale

Enabling connection_throttling helps the PostgreSQL Database to set the verbosity of logged messages. This in turn generates query and error logs with respect to concurrent connections that could lead to a successful Denial of Service (DoS) attack by exhausting connection resources. A system can also fail or be degraded by an overload of legitimate users. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.

Impact

None documented.

Audit Procedure

Audit from Azure Portal

1. Login to Azure Portal using https://portal.azure.com.
2. Go to Azure Database for PostgreSQL servers.
3. For each server, under Settings, click Server parameters.
4. In the filter bar, type connection_throttle.enable.
5. Ensure that VALUE for connection_throttle.enable is set to ON.

Audit from Azure CLI

Ensure the below command returns a value of on:

az postgres flexible-server parameter show --resource-group <resourceGroup> --server-name <serverName> --name connection_throttle.enable

Audit from PowerShell

Ensure the below command returns a Value of on:

Get-AzPostgreSqlFlexibleServerConfiguration -ResourceGroupName <resourceGroup> -ServerName <serverName> -Name connection_throttle.enable

Audit from Azure Policy

Policy ID: dacf07fa-0eea-4486-80bc-b93fae88ac40 Name: 'Connection throttling should be enabled for PostgreSQL flexible servers'

Expected Result

The connection_throttle.enable server parameter should be set to ON.

Remediation

Remediate from Azure Portal

1. Login to Azure Portal using https://portal.azure.com.
2. Go to Azure Database for PostgreSQL servers.
3. For each server, under Settings, click Server parameters.
4. In the filter bar, type connection_throttle.enable.
5. Set connection_throttle.enable to ON.
6. Click Save.

Remediate from Azure CLI

Use the below command to enable connection_throttle.enable:

az postgres flexible-server parameter set --resource-group <resourceGroup> --server-name <serverName> --name connection_throttle.enable --value on

Remediate from PowerShell

Use the below command to update connection_throttling configuration:

Update-AzPostgreSqlFlexibleServerConfiguration -ResourceGroupName <resourceGroup> -ServerName <serverName> -Name connection_throttle.enable -Value on

Default Value

By default, connection_throttle.enable is disabled (set to off).

References

1. https://learn.microsoft.com/en-us/rest/api/postgresql/flexibleserver/configurations/list-by-server
2. https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/how-to-configure-server-parameters-using-portal
3. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation
4. https://learn.microsoft.com/en-us/powershell/module/az.postgresql/get-azpostgresqlflexibleserverconfiguration
5. https://learn.microsoft.com/en-us/powershell/module/az.postgresql/update-azpostgresqlflexibleserverconfiguration

Profile

• Level 1