Back to Checks
azure

Flexible PostgreSQL server has connection_throttling enabled

postgresql_flexible_server_connection_throttling_on
Service: postgresqlSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.dbforpostgresql/flexibleservers

Azure PostgreSQL flexible servers where the connection_throttling parameter is set to ON

Prowler logoProwlerprowler-provider-azure

Risk

Without connection_throttling, bursts of new sessions can exhaust connection slots and CPU, degrading availability and causing timeouts.

Reduced telemetry delays detection of DoS or runaway clients, extending impact and recovery time.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks postgresql_flexible_server_connection_throttling_on

Recommendation

Enable connection_throttling and align connection limits with expected load.

Apply defense in depth: use connection pooling, exponential backoff, and alerts on connection spikes; prefer private access and restrictive networking to reduce exposure.

Remediation

CLI

az postgres flexible-server parameter set --resource-group <resourceGroupName> --server-name <serverName> --name connection_throttle.enable --value on

Terraform

resource "azurerm_postgresql_flexible_server_configuration" "<example_resource_name>" {
  name      = "connection_throttle.enable"
  server_id = "<example_resource_id>"
  value     = "on" # CRITICAL: Enables connection_throttle.enable to pass the check
}

NativeIaC

// Configure an existing Flexible Server parameter
resource exampleServer 'Microsoft.DBforPostgreSQL/flexibleServers@2022-12-01' existing = {
  name: '<example_resource_name>'
}

resource connectionThrottling 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2022-12-01' = {
  name: 'connection_throttle.enable'
  parent: exampleServer
  properties: {
    value: 'on' // CRITICAL: Enables connection_throttle.enable to pass the check
  }
}

Other

1Sign in to Azure Portal and go to Azure Database for PostgreSQL flexible servers
2Select the target server
3In Settings, click Server parameters
4Search for connection_throttle.enable
5Set the value to ON and click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.postgresql.postgresql_client import (
    postgresql_client,
)


class postgresql_flexible_server_connection_throttling_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for (
            subscription,
            flexible_servers,
        ) in postgresql_client.flexible_servers.items():
            subscription_name = postgresql_client.subscriptions.get(
                subscription, subscription
            )
            for server in flexible_servers:
                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has connection_throttling disabled"
                if server.connection_throttling == "ON":
                    report.status = "PASS"
                    report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has connection_throttling enabled"
                findings.append(report)

        return findings

References