Skip to main content

📝 Azure PostgreSQL Single Server log_connections Parameter is not set to ON 🟢

  • Contextual name: 📝 Single Server log_connections Parameter is not set to ON 🟢
  • ID: /ce/ca/azure/postgresql-database/single-server-log-connections-parameter
  • Located in: 📁 Azure PostgreSQL Database

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY
    • RELIABILITY
    • PERFORMANCE

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-1518c16e1

Logic​

Description​

Open File

Description​

Enable log_connections on PostgreSQL Single Servers.

NOTE: This recommendation currently only applies to Single Server, not Flexible Server. See additional information below for details about the planned retirement of Azure PostgreSQL Single Server.

Rationale​

Enabling log_connections helps PostgreSQL Database to log attempted connection to the server, as well as successful completion of client authentication. Log data can be used to identify, troubleshoot, and repair configuration errors and suboptimal performance.

Audit​

From Azure Portal​
  1. Login to Azure Portal using https://portal.azure.com.
  2. Go to Azure Database for PostgreSQL servers.
  3. For each database, under Settings, click Server parameters.
  4. In the filter bar, type log_connections.
  5. Ensure that log_connections is set to ON.
From Azure CLI​

Ensure the below command returns a Value of ON:

az postgres server configuration show --resource-group <resourceGroupName> --server-name <serverName> --name log_connections

... [see more](description.md)

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Login to Azure Portal using https://portal.azure.com.
  2. Go to Azure Database for PostgreSQL servers.
  3. For each database, under Settings, click Server parameters.
  4. In the filter bar, type log_connections.
  5. Set log_connections to ON.
  6. Click Save.

From Azure CLI​

Use the below command to update log_connections configuration:

az postgres server configuration set --resource-group <resourceGroupName> --server-name <serverName> --name log_connections --value on

From PowerShell​

Use the below command to update log_connections configuration:

Update-AzPostgreSqlConfiguration -ResourceGroupName <ResourceGroupName> -ServerName <ServerName> -Name log_connections -Value on

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 CIS Azure v1.1.0 → 💼 4.14 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server11
💼 CIS Azure v1.3.0 → 💼 4.3.4 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server - Level 1 (Automated)11
💼 CIS Azure v1.4.0 → 💼 4.3.3 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server - Level 1 (Automated)11
💼 CIS Azure v1.5.0 → 💼 4.3.3 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server - Level 1 (Automated)11
💼 CIS Azure v2.0.0 → 💼 4.3.3 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server - Level 1 (Automated)11
💼 CIS Azure v2.1.0 → 💼 4.3.3 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server - Level 1 (Automated)11
💼 CIS Azure v3.0.0 → 💼 5.2.6 [LEGACY] Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL single server (Automated)1
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration49
💼 FedRAMP High Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)723
💼 FedRAMP High Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)62126
💼 FedRAMP High Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)1719
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)247
💼 FedRAMP High Security Controls → 💼 CM-3 Configuration Change Control (M)(H)421
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)4648
💼 FedRAMP Low Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)23
💼 FedRAMP Low Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)19
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)47
💼 FedRAMP Moderate Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)23
💼 FedRAMP Moderate Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)226
💼 FedRAMP Moderate Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)19
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)47
💼 FedRAMP Moderate Security Controls → 💼 CM-3 Configuration Change Control (M)(H)217
💼 ISO/IEC 27001:2013 → 💼 A.12.4.1 Event logging1618
💼 ISO/IEC 27001:2013 → 💼 A.14.1.1 Information security requirements analysis and specification66
💼 ISO/IEC 27001:2022 → 💼 8.15 Logging1920
💼 ISO/IEC 27001:2022 → 💼 8.20 Networks security55
💼 NIST CSF v1.1 → 💼 DE.AE-2: Detected events are analyzed to understand attack targets and methods1922
💼 NIST CSF v1.1 → 💼 DE.AE-3: Event data are collected and correlated from multiple sources and sensors1922
💼 NIST CSF v1.1 → 💼 DE.CM-1: The network is monitored to detect potential cybersecurity events1928
💼 NIST CSF v1.1 → 💼 DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events2124
💼 NIST CSF v1.1 → 💼 DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed1923
💼 NIST CSF v1.1 → 💼 DE.DP-4: Event detection information is communicated3033
💼 NIST CSF v1.1 → 💼 ID.SC-4: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations1619
💼 NIST CSF v1.1 → 💼 PR.IP-2: A System Development Life Cycle to manage systems is implemented66
💼 NIST CSF v1.1 → 💼 PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy1720
💼 NIST CSF v1.1 → 💼 RS.AN-1: Notifications from detection systems are investigated1922
💼 NIST CSF v1.1 → 💼 RS.CO-2: Incidents are reported consistent with established criteria2023
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities26
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources26
💼 NIST CSF v2.0 → 💼 DE.AE-06: Information on adverse events is provided to authorized staff and tools33
💼 NIST CSF v2.0 → 💼 DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis22
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events83
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events59
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events27
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events89
💼 NIST CSF v2.0 → 💼 GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship26
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked24
💼 NIST CSF v2.0 → 💼 ID.RA-10: Critical suppliers are assessed prior to acquisition26
💼 NIST CSF v2.0 → 💼 RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging23
💼 NIST CSF v2.0 → 💼 RS.CO-02: Internal and external stakeholders are notified of incidents30
💼 NIST CSF v2.0 → 💼 RS.MA-02: Incident reports are triaged and validated22
💼 NIST SP 800-53 Revision 5 → 💼 AC-6(9) Least Privilege _ Log Use of Privileged Functions1516
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation44547
💼 NIST SP 800-53 Revision 5 → 💼 CM-3 Configuration Change Control81521