Enable "CONNECTION_THROTTLING" Parameter for PostgreSQL Servers

More Info:

Ensure that “connection_throttling” server parameter is enabled for all PostgreSQL database servers provisioned within your Microsoft Azure cloud account. The “connection_throttling” parameter enables temporary connection throttling per IP address for too many invalid login failures.

Risk Level

Medium

Address

Security

Compliance Standards

CISAZURE, CBP, SOC2, NISTCSF, PCIDSS

Triage and Remediation

Remediation

Using Console

Using CLI

Using Python

To remediate the misconfiguration “Enable CONNECTION_THROTTLING Parameter for PostgreSQL Servers” in Azure using Python, you can follow the below steps:

Import the required modules:

from azure.identity import DefaultAzureCredential
from azure.mgmt.postgresql import PostgreSQLManagementClient
from azure.mgmt.postgresql.models import Configuration, ConfigurationValue

Authenticate to Azure using DefaultAzureCredential:

credential = DefaultAzureCredential()

Create a PostgreSQLManagementClient object:

subscription_id = '<subscription_id>'
resource_group_name = '<resource_group_name>'
server_name = '<server_name>'

client = PostgreSQLManagementClient(credential, subscription_id)

Get the current configuration of the PostgreSQL server:

current_configuration = client.configurations.list_by_server(resource_group_name, server_name)

Check if the “CONNECTION_THROTTLING” parameter is already enabled:

is_connection_throttling_enabled = False

for configuration in current_configuration:
    if configuration.name == "CONNECTION_THROTTLING":
        is_connection_throttling_enabled = True
        break

If the “CONNECTION_THROTTLING” parameter is not enabled, set it to “ON” and update the configuration:

if not is_connection_throttling_enabled:
    new_configuration = Configuration(name="CONNECTION_THROTTLING",
                                       value=ConfigurationValue(default_value="on",
                                                                source="system-default"))
    client.configurations.create_or_update(resource_group_name, server_name, "CONNECTION_THROTTLING", new_configuration)

Verify that the parameter has been enabled by checking the updated configuration:

updated_configuration = client.configurations.list_by_server(resource_group_name, server_name)

for configuration in updated_configuration:
    if configuration.name == "CONNECTION_THROTTLING":
        print("CONNECTION_THROTTLING parameter is now enabled")

With these steps, you should be able to remediate the misconfiguration “Enable CONNECTION_THROTTLING Parameter for PostgreSQL Servers” in Azure using Python.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Enable "CONNECTION_THROTTLING" Parameter for PostgreSQL Servers

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation