Back to Checks
azure

PostgreSQL Flexible Server has disconnection logging enabled

postgresql_flexible_server_log_disconnections_on
Service: postgresqlSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.dbforpostgresql/flexibleservers

Azure Database for PostgreSQL Flexible Server uses the log_disconnections setting to record when client sessions end and how long they lasted.

Prowler logoProwlerprowler-provider-azure

Risk

Without disconnection logs, session timelines and user activity are opaque, weakening auditability and forensics.

Abuse such as stolen credentials, short-lived access, or hijacked sessions can go unnoticed, enabling data exfiltration and privilege misuse, impacting confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks postgresql_flexible_server_log_disconnections_on

Recommendation

Enable log_disconnections on all Flexible Servers. Complement with log_connections and appropriate duration/statement logging, centralize and retain logs, and alert on abnormal connect/disconnect patterns. Restrict log access. This enforces accountability, supports defense in depth, and speeds incident response.

Remediation

CLI

az postgres flexible-server parameter set --resource-group <RESOURCE_GROUP> --server-name <SERVER_NAME> --name log_disconnections --value on

Terraform

# Enable log_disconnections on a PostgreSQL Flexible Server
resource "azurerm_postgresql_flexible_server_configuration" "log_disconnections" {
  server_id = "<example_resource_id>"
  name      = "log_disconnections"
  value     = "on" # Critical: turns log_disconnections ON to pass the check
}

NativeIaC

// Enable log_disconnections on an existing PostgreSQL Flexible Server
resource server 'Microsoft.DBforPostgreSQL/flexibleServers@2022-12-01' existing = {
  name: '<example_resource_name>'
}

resource logDisconnections 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2022-12-01' = {
  name: 'log_disconnections'
  parent: server
  properties: {
    value: 'on' // Critical: turns log_disconnections ON to pass the check
  }
}

Other

1In Azure Portal, go to Azure Database for PostgreSQL flexible servers
2Select your server
3Under Settings, open Server parameters
4Search for log_disconnections
5Set it to ON
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.postgresql.postgresql_client import (
    postgresql_client,
)


class postgresql_flexible_server_log_disconnections_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for (
            subscription,
            flexible_servers,
        ) in postgresql_client.flexible_servers.items():
            subscription_name = postgresql_client.subscriptions.get(
                subscription, subscription
            )
            for server in flexible_servers:
                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has log_disconnections disabled"
                if server.log_disconnections == "ON":
                    report.status = "PASS"
                    report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has log_disconnections enabled"
                findings.append(report)

        return findings

References