Back to Checks
azure

PostgreSQL flexible server log_retention_days is between 4 and 7 days

postgresql_flexible_server_log_retention_days_greater_3
Service: postgresqlSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.dbforpostgresql/flexibleservers

Log retention on Azure Database for PostgreSQL Flexible Server is governed by log_retention_days. Configuration is assessed as set and within 4-7 days versus unset or outside this range.

Prowler logoProwlerprowler-provider-azure

Risk

Insufficient or disabled log retention limits the audit trail needed to detect brute-force, SQL injection, or insider misuse, impeding investigation. Excessive retention enlarges exposure if logs are accessed, risking sensitive query data leakage and policy violations. This reduces visibility and weakens confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks postgresql_flexible_server_log_retention_days_greater_3

Recommendation

Set log_retention_days to 4-7 to balance visibility and exposure. Export logs to centralized SIEM or secure storage for longer retention and analysis. Enforce least privilege, encryption, and immutability on log data, and monitor for gaps. Apply defense in depth with alerts on anomalous queries and failed logins.

Remediation

CLI

az postgres flexible-server parameter set --resource-group <RESOURCE_GROUP> --server-name <SERVER_NAME> --name logfiles.retention_days --value 7

Terraform

resource "azurerm_postgresql_flexible_server_configuration" "<example_resource_name>" {
  server_id = "<example_resource_id>"
  name      = "logfiles.retention_days"
  value     = "7" # Critical: sets retention within 4-7 to pass the check
}

NativeIaC

// Set log retention to a compliant value (4-7 days) for an existing Flexible Server
resource cfg 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2023-03-01-preview' = {
  name: '<example_resource_name>/logfiles.retention_days'
  properties: {
    value: '7' // Critical: sets logfiles.retention_days within 4-7 to pass the check
  }
}

Other

1In Azure Portal, go to Azure Database for PostgreSQL > Flexible servers and open your server
2Select Server parameters
3Search for logfiles.retention_days
4Set the value to a number between 4 and 7 (e.g., 7)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.postgresql.postgresql_client import (
    postgresql_client,
)


class postgresql_flexible_server_log_retention_days_greater_3(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for (
            subscription,
            flexible_servers,
        ) in postgresql_client.flexible_servers.items():
            subscription_name = postgresql_client.subscriptions.get(
                subscription, subscription
            )
            for server in flexible_servers:
                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has log_retention disabled"
                if server.log_retention_days:
                    report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has log_retention set to {server.log_retention_days}"
                    if (
                        int(server.log_retention_days) > 3
                        and int(server.log_retention_days) < 8
                    ):
                        report.status = "PASS"
                findings.append(report)

        return findings

References