Back to Checks
azure

PostgreSQL flexible server has log_connections enabled

postgresql_flexible_server_log_connections_on
Service: postgresqlSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.dbforpostgresql/flexibleservers

Azure Database for PostgreSQL Flexible Server evaluates the log_connections setting that controls logging of client connection attempts and authentication results.

The finding indicates whether this parameter is set to ON.

Prowler logoProwlerprowler-provider-azure

Risk

Without connection logging, visibility of access attempts is lost, making brute force and credential stuffing harder to detect. This weakens confidentiality and integrity, hinders incident investigations, and can mask lateral movement or unauthorized data access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks postgresql_flexible_server_log_connections_on

Recommendation

Set log_connections to ON and integrate logs with centralized monitoring. Define retention and alerts for abnormal patterns. Combine with least privilege, strong authentication, and network restrictions to deliver defense in depth and prevent unauthorized access.

Remediation

Other

1Sign in to the Azure portal
2Go to: Azure Database for PostgreSQL > Flexible servers > select <example_resource_name>
3Under Settings, open Server parameters and search for "log_connections"
4Confirm the parameter shows Value: ON and is Read-only (no change required)

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.postgresql.postgresql_client import (
    postgresql_client,
)


class postgresql_flexible_server_log_connections_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for (
            subscription,
            flexible_servers,
        ) in postgresql_client.flexible_servers.items():
            subscription_name = postgresql_client.subscriptions.get(
                subscription, subscription
            )
            for server in flexible_servers:
                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has log_connections disabled"
                if server.log_connections == "ON":
                    report.status = "PASS"
                    report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has log_connections enabled"
                findings.append(report)

        return findings

References