cis-azure-database-6-5

name	cis-azure-database-6.5
description	Ensure server parameter 'connection_throttle.enable' is set to 'ON' for PostgreSQL server
category	cis-azure-database
version	2.0.0
author	cyberstrike-official
tags	["cis","azure","postgresql","database"]
cis_id	6.5
cis_benchmark	CIS Microsoft Azure Database Services Benchmark v2.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

6.5 Ensure server parameter 'connection_throttle.enable' is set to 'ON' for PostgreSQL server (Automated)

Profile Applicability

• Level 1

Description

Enable connection_throttling on PostgreSQL flexible servers.

Rationale

Enabling connection_throttling helps the PostgreSQL Database to set the verbosity of logged messages. This in turn generates query and error logs with respect to concurrent connections that could lead to a successful Denial of Service (DoS) attack by exhausting connection resources. A system can also fail or be degraded by an overload of legitimate users. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.

Impact

None documented.

Audit Procedure

Audit from Azure Portal

1. Login to Azure Portal using https://portal.azure.com.
2. Go to Azure Database for PostgreSQL servers.
3. For each server, under Settings, click Server parameters.
4. In the filter bar, type connection_throttle.enable.
5. Ensure that VALUE for connection_throttle.enable is set to ON.

Audit from Azure CLI

Ensure the below command returns a value of on:

az postgres flexible-server parameter show --resource-group <resourceGroup> --server-name <serverName> --name connection_throttle.enable

Audit from PowerShell

Ensure the below command returns a Value of on:

Get-AzPostgreSqlFlexibleServerConfiguration -ResourceGroupName <resourceGroup> -ServerName <serverName> -Name connection_throttle.enable

Audit from Azure Policy

Policy ID: dacf07fa-0eea-4486-80bc-b93fae88ac40 Name: 'Connection throttling should be enabled for PostgreSQL flexible servers'

Expected Result

The connection_throttle.enable server parameter should be set to ON.

Remediation

Remediate from Azure Portal

1. Login to Azure Portal using https://portal.azure.com.