Skip to main content

🛡️ Azure PostgreSQL Flexible Server connection_throttle.enable Parameter is not set to ON🟢

  • Contextual name: 🛡️ Flexible Server connection_throttle.enable Parameter is not set to ON🟢
  • ID: /ce/ca/azure/postgresql-database/flexible-server-connection-throttle-enable-parameter
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: RELIABILITY, PERFORMANCE

Stats​

not available

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-850beea81

Description​

Open File

Description​

Enable connection throttling on PostgreSQL flexible servers.

Rationale​

Enabling connection_throttling helps PostgreSQL limit concurrent connections that could lead to a Denial of Service (DoS) attack by exhausting connection resources. A system can also fail or be degraded by an overload of legitimate users. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and suboptimal performance.

Audit​

From Azure Portal​
  1. Log in to Azure Portal using https://portal.azure.com.
  2. Go to Azure Database for PostgreSQL flexible servers.
  3. For each database, under Settings, click Server parameters.
  4. In the filter bar, type connection_throttle.enable.
  5. Ensure that VALUE for connection_throttle.enable is set to ON.
From Azure CLI​

Ensure the following command returns a value of ON:

az postgres flexible-server parameter show \
    --resource-group {{resource-group-name}} \
    --server-name {{server-name}} \
    --name connection_throttle.enable

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Log in to Azure Portal using https://portal.azure.com.
  2. Go to Azure Database for PostgreSQL flexible servers.
  3. For each database, under Settings, click Server parameters.
  4. Search for connection_throttle.enable.
  5. Set connection_throttle.enable to ON.
  6. Click Save.

From Azure CLI​

Use the following command to enable connection_throttle.enable:

az postgres flexible-server parameter set \
    --resource-group {{resource-group-name}} \
    --server-name {{server-name}} \
    --name connection_throttle.enable \
    --value on

From PowerShell​

Use the following command to update connection_throttle.enable:

Update-AzPostgreSqlFlexibleServerConfiguration `
    -ResourceGroupName {{resource-group-name}} `
    -ServerName {{server-name}} `
    -Name connection_throttle.enable `
    -Value on

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS Azure v1.1.0 → 💼 4.17 Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server11no data
💼 CIS Azure v1.3.0 → 💼 4.3.6 Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server - Level 1 (Automated)11no data
💼 CIS Azure v1.4.0 → 💼 4.3.5 Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server - Level 1 (Automated)11no data
💼 CIS Azure v1.5.0 → 💼 4.3.5 Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server - Level 1 (Automated)11no data
💼 CIS Azure v2.0.0 → 💼 4.3.5 Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server - Level 1 (Automated)11no data
💼 CIS Azure v2.1.0 → 💼 4.3.5 Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server - Level 1 (Automated)11no data
💼 CIS Azure v3.0.0 → 💼 5.2.3 Ensure server parameter 'connection_throttle.enable' is set to 'ON' for PostgreSQL flexible server (Automated)1no data
💼 Cloudaware Framework → 💼 Performance Tuning6no data
💼 Cloudaware Framework → 💼 System Configuration61no data
💼 FedRAMP High Security Controls → 💼 CP-9 System Backup (L)(M)(H)5416no data
💼 FedRAMP High Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)145163no data
💼 FedRAMP High Security Controls → 💼 SI-4(4) Inbound and Outbound Communications Traffic (M)(H)68no data
💼 FedRAMP Low Security Controls → 💼 CP-9 System Backup (L)(M)(H)14no data
💼 FedRAMP Low Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)10no data
💼 FedRAMP Moderate Security Controls → 💼 CP-9 System Backup (L)(M)(H)216no data
💼 FedRAMP Moderate Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)714no data
💼 FedRAMP Moderate Security Controls → 💼 SI-4(4) Inbound and Outbound Communications Traffic (M)(H)8no data
💼 ISO/IEC 27001:2013 → 💼 A.17.1.2 Implementing information security continuity34no data
💼 ISO/IEC 27001:2022 → 💼 8.15 Logging2035no data
💼 ISO/IEC 27001:2022 → 💼 8.20 Networks security615no data
💼 NIST CSF v1.1 → 💼 DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed1034no data
💼 NIST CSF v1.1 → 💼 DE.AE-2: Detected events are analyzed to understand attack targets and methods1924no data
💼 NIST CSF v1.1 → 💼 DE.AE-3: Event data are collected and correlated from multiple sources and sensors1938no data
💼 NIST CSF v1.1 → 💼 DE.AE-4: Impact of events is determined1314no data
💼 NIST CSF v1.1 → 💼 DE.CM-1: The network is monitored to detect potential cybersecurity events1963no data
💼 NIST CSF v1.1 → 💼 DE.CM-5: Unauthorized mobile code is detected1112no data
💼 NIST CSF v1.1 → 💼 DE.CM-6: External service provider activity is monitored to detect potential cybersecurity events67no data
💼 NIST CSF v1.1 → 💼 DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed1924no data
💼 NIST CSF v1.1 → 💼 DE.DP-2: Detection activities comply with all applicable requirements67no data
💼 NIST CSF v1.1 → 💼 DE.DP-3: Detection processes are tested1314no data
💼 NIST CSF v1.1 → 💼 DE.DP-4: Event detection information is communicated3033no data
💼 NIST CSF v1.1 → 💼 DE.DP-5: Detection processes are continuously improved1316no data
💼 NIST CSF v1.1 → 💼 ID.BE-4: Dependencies and critical functions for delivery of critical services are established4no data
💼 NIST CSF v1.1 → 💼 ID.BE-5: Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)34no data
💼 NIST CSF v1.1 → 💼 ID.RA-1: Asset vulnerabilities are identified and documented1316no data
💼 NIST CSF v1.1 → 💼 PR.IP-4: Backups of information are conducted, maintained, and tested510no data
💼 NIST CSF v1.1 → 💼 PR.IP-8: Effectiveness of protection technologies is shared67no data
💼 NIST CSF v1.1 → 💼 PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed45no data
💼 NIST CSF v1.1 → 💼 PR.PT-5: Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations34no data
💼 NIST CSF v1.1 → 💼 RS.AN-1: Notifications from detection systems are investigated1924no data
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities51no data
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources66no data
💼 NIST CSF v2.0 → 💼 DE.AE-04: The estimated impact and scope of adverse events are understood14no data
💼 NIST CSF v2.0 → 💼 DE.AE-06: Information on adverse events is provided to authorized staff and tools33no data
💼 NIST CSF v2.0 → 💼 DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis38no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events185no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events105no data
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events51no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events182no data
💼 NIST CSF v2.0 → 💼 GV.OC-04: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated4no data
💼 NIST CSF v2.0 → 💼 GV.OC-05: Outcomes, capabilities, and services that the organization depends on are understood and communicated4no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained89no data
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties62no data
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities62no data
💼 NIST CSF v2.0 → 💼 ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved5no data
💼 NIST CSF v2.0 → 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded47no data
💼 NIST CSF v2.0 → 💼 PR.DS-11: Backups of data are created, protected, maintained, and tested18no data
💼 NIST CSF v2.0 → 💼 PR.IR-03: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations22no data
💼 NIST CSF v2.0 → 💼 RS.MA-02: Incident reports are triaged and validated25no data
💼 SOC 2 → 💼 CC4.2-3 Monitors Corrective Action66no data
💼 SOC 2 → 💼 CC5.2-3 Establishes Relevant Security Management Process Controls Activities1636no data