Enable In-Transit Encryption for PostgreSQL Database Servers

More Info:

Ensure that Microsoft Azure PostgreSQL server data is encrypted in transit in order to meet security and compliance requirements. In-transit encryption helps prevent unauthorized users from getting access to critical data available in your Azure PostgreSQL databases.

Risk Level

High

Address

Security

Compliance Standards

CISAZURE, CBP, HITRUST, SOC2, NISTCSF, PCIDSS, FedRAMP

Triage and Remediation

Remediation

Using Console

Using CLI

To remediate the misconfiguration of enabling In-Transit Encryption for PostgreSQL Database Servers in AZURE using AZURE CLI, you can follow these step-by-step instructions:

Open the Azure CLI in your preferred terminal.
Login to your Azure account using the command below:
```
az login
```
Once you are logged in, set the subscription where your PostgreSQL server is located using the command below:
```
az account set --subscription <subscription_name>
```
Next, set the resource group where your PostgreSQL server is located using the command below:
```
az group set --name <resource_group_name>
```
Now, enable SSL enforcement for your PostgreSQL server using the command below:
```
az postgres server update --resource-group <resource_group_name> --name <postgresql_server_name> --ssl-enforcement Enabled
```
This command will enable SSL enforcement for your PostgreSQL server which will encrypt the data in transit.
Finally, verify that SSL enforcement is enabled for your PostgreSQL server by running the following command:
```
az postgres server show --resource-group <resource_group_name> --name <postgresql_server_name> --query sslEnforcement
```
This command will return the value “Enabled” which confirms that SSL enforcement is enabled for your PostgreSQL server.

By following these steps, you will be able to remediate the misconfiguration of enabling In-Transit Encryption for PostgreSQL Database Servers in AZURE using AZURE CLI.

Using Python

To remediate the misconfiguration “Enable In-Transit Encryption for PostgreSQL Database Servers” in Azure using Python, you can follow the below steps:

Import the necessary libraries:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.postgresql import PostgreSQLManagementClient
from azure.mgmt.postgresql.models import ServerUpdateParameters

Authenticate with Azure using Service Principal credentials:

TENANT_ID = 'your_tenant_id'
CLIENT_ID = 'your_client_id'
CLIENT_SECRET = 'your_client_secret'
SUBSCRIPTION_ID = 'your_subscription_id'

credentials = ServicePrincipalCredentials(
    client_id=CLIENT_ID,
    secret=CLIENT_SECRET,
    tenant=TENANT_ID
)

Instantiate the PostgreSQLManagementClient:

client = PostgreSQLManagementClient(credentials, SUBSCRIPTION_ID)

Get the existing server details:

resource_group_name = 'your_resource_group_name'
server_name = 'your_server_name'

server = client.servers.get(resource_group_name, server_name)

Update the server with the in-transit encryption enabled:

params = ServerUpdateParameters(
    ssl_enforcement="Enabled"
)

client.servers.update(resource_group_name, server_name, params)

Verify that the in-transit encryption is enabled:

server = client.servers.get(resource_group_name, server_name)
print(server.ssl_enforcement)

These steps will enable in-transit encryption for PostgreSQL Database Servers in Azure using Python.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Enable In-Transit Encryption for PostgreSQL Database Servers

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation