Back to Checks
azure

PostgreSQL flexible server has geo-redundant backup enabled

postgresql_flexible_server_geo_redundant_backup_enabled
Service: postgresqlSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:microsoft.dbforpostgresql/flexibleservers

Azure PostgreSQL Flexible Server is evaluated for geo-redundant backup. Geo-redundant backup stores backup copies in a paired Azure region, enabling restore and cross-region disaster recovery.

Prowler logoProwlerprowler-provider-azure

Risk

Without geo-redundant backup, a regional disaster can cause permanent data loss. Locally redundant backups only protect against storage hardware failures within the same region and cannot be restored if the primary region becomes unavailable.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks postgresql_flexible_server_geo_redundant_backup_enabled

Recommendation

Enable geo-redundant backup on PostgreSQL Flexible Servers so backups are replicated to the paired Azure region and can be restored during a regional outage. Because this is set at server creation, plan a migration for existing servers, and pair it with an appropriate backup retention period and periodic restore testing.

Remediation

CLI

az postgres flexible-server create --name <server_name> --resource-group <resource_group_name> --location <region> --geo-redundant-backup Enabled

Terraform

# Terraform: PostgreSQL Flexible Server with geo-redundant backup (set at creation)
resource "azurerm_postgresql_flexible_server" "<example_resource_name>" {
  name                         = "<example_resource_name>"
  resource_group_name          = "<example_resource_name>"
  location                     = "<region>"
  geo_redundant_backup_enabled = true # CRITICAL: stores backups in the paired region
}

NativeIaC

// Bicep: PostgreSQL Flexible Server with geo-redundant backup (set at creation)
resource postgresql 'Microsoft.DBforPostgreSQL/flexibleServers@2023-06-01-preview' = {
  name: '<example_resource_name>'
  location: '<region>'
  properties: {
    backup: {
      geoRedundantBackup: 'Enabled' // CRITICAL: stores backups in the paired region
    }
  }
}

Other

1Geo-redundant backup must be configured when the server is created; it cannot be enabled on an existing server
2In the Azure portal, start creating a new Azure Database for PostgreSQL flexible server
3On the Basics tab, under Compute + storage, open Configure server
4Set Geographically redundant backup to Enabled and save
5Finish creating the server and migrate workloads to it

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.postgresql.postgresql_client import (
    postgresql_client,
)


class postgresql_flexible_server_geo_redundant_backup_enabled(Check):
    """
    Ensure Azure PostgreSQL Flexible Servers have geo-redundant backup enabled.

    This check evaluates whether each Azure PostgreSQL Flexible Server stores backups in a paired Azure region, enabling cross-region disaster recovery.

    - PASS: The server has geo-redundant backup enabled (geo_redundant_backup is "Enabled").
    - FAIL: The server does not have geo-redundant backup enabled.
    """

    def execute(self) -> Check_Report_Azure:
        findings = []
        for (
            subscription,
            flexible_servers,
        ) in postgresql_client.flexible_servers.items():
            subscription_name = postgresql_client.subscriptions.get(
                subscription, subscription
            )
            for server in flexible_servers:
                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
                report.subscription = subscription
                if server.geo_redundant_backup == "Enabled":
                    report.status = "PASS"
                    report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has geo-redundant backup enabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) does not have geo-redundant backup enabled."
                findings.append(report)
        return findings

References