Back to Checks
azure

PostgreSQL Flexible Server enforces SSL connections

postgresql_flexible_server_enforce_ssl_enabled
Service: postgresqlSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.dbforpostgresql/flexibleservers

Azure Database for PostgreSQL flexible servers are evaluated for encrypted in-transit connections, specifically whether require_secure_transport is set to ON to force TLS for all client sessions.

Prowler logoProwlerprowler-provider-azure

Risk

Without enforced TLS, clients may connect in plaintext or with weak settings, exposing credentials and data to man-in-the-middle, query tampering, and session hijacking. This undermines confidentiality and integrity, and can enable lateral movement if stolen creds are reused.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks postgresql_flexible_server_enforce_ssl_enabled

Recommendation

Enforce encryption in transit: set require_secure_transport=ON, prefer TLS 1.3 (or at least ssl_min_protocol_version=1.2), and require clients to verify server identity. Disable mixed modes, rotate certificates, and restrict access via private endpoints to apply defense in depth.

Remediation

CLI

az postgres flexible-server parameter set --resource-group <RESOURCE_GROUP> --server-name <SERVER_NAME> --name require_secure_transport --value ON

Terraform

# Enable SSL/TLS enforcement on a PostgreSQL Flexible Server
resource "azurerm_postgresql_flexible_server_configuration" "<example_resource_name>" {
  name      = "require_secure_transport"   # CRITICAL: Target the SSL enforcement parameter
  server_id = "<example_resource_id>"      # ID of the target flexible server
  value     = "ON"                          # CRITICAL: Enforce SSL/TLS
}

NativeIaC

// Enable SSL/TLS enforcement on an existing PostgreSQL Flexible Server
resource server 'Microsoft.DBforPostgreSQL/flexibleServers@2023-12-01' existing = {
  name: '<example_resource_name>'
}

resource requireSecureTransport 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2023-12-01' = {
  name: '${server.name}/require_secure_transport'
  properties: {
    value: 'ON' // CRITICAL: Enforces SSL/TLS by turning require_secure_transport ON
  }
}

Other

1Sign in to the Azure portal
2Go to: Azure Database for PostgreSQL flexible server > your server
3Select Server parameters
4Search for require_secure_transport
5Set it to ON
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.postgresql.postgresql_client import (
    postgresql_client,
)


class postgresql_flexible_server_enforce_ssl_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for (
            subscription,
            flexible_servers,
        ) in postgresql_client.flexible_servers.items():
            subscription_name = postgresql_client.subscriptions.get(
                subscription, subscription
            )
            for server in flexible_servers:
                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has enforce ssl disabled"
                if server.require_secure_transport == "ON":
                    report.status = "PASS"
                    report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has enforce ssl enabled"
                findings.append(report)

        return findings

References