Azure audit postgressql enable log duration remediation

Using Console

To remediate the “LOG_DURATION” parameter misconfiguration for PostgreSQL Servers in Azure, you can follow the below steps:

Log in to the Azure portal (https://portal.azure.com/).
Navigate to the PostgreSQL server for which you want to enable the “LOG_DURATION” parameter.
Click on the “Configuration” tab from the left-hand side menu.
Scroll down to the “Parameters” section and search for the “log_duration” parameter.
If the “log_duration” parameter is not present, click on the ”+ Add parameter” button and add the parameter.
Set the value of the “log_duration” parameter to “on” to enable it.
Click on the “Save” button to save the changes.

After following the above steps, the “LOG_DURATION” parameter will be enabled for the PostgreSQL server in Azure.

Using CLI

To remediate the misconfiguration of enabling the “LOG_DURATION” parameter for PostgreSQL servers in AZURE using AZURE CLI, you can follow the below steps:

Open the AZURE CLI and log in to your AZURE account.
Run the below command to get the list of all the PostgreSQL servers in your subscription:
az postgres server list
Select the PostgreSQL server for which you want to enable the “LOG_DURATION” parameter and note down its resource group name and server name.
Run the below command to enable the “LOG_DURATION” parameter for the selected PostgreSQL server:
az postgres server configuration set --resource-group <resource_group_name> --server-name <server_name> --name log_duration --value on
Replace <resource_group_name> and <server_name> with the actual values of the resource group name and server name noted down in step 3.
Verify that the “LOG_DURATION” parameter is enabled for the PostgreSQL server by running the below command:
az postgres server configuration list --resource-group <resource_group_name> --server-name <server_name> --query "[?name=='log_duration']"
If the output shows the value of “value” parameter as “on”, then the “LOG_DURATION” parameter is enabled for the PostgreSQL server.

By following the above steps, you can remediate the misconfiguration of enabling the “LOG_DURATION” parameter for PostgreSQL servers in AZURE using AZURE CLI.

Using Python

To enable the “LOG_DURATION” parameter for PostgreSQL servers in Azure using python, you can follow the below steps:

Import the necessary libraries:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.rdbms.postgresql import PostgreSQLManagementClient

Set the credentials for authentication:

TENANT_ID = '<your tenant id>'
CLIENT = '<your client id>'
KEY = '<your client secret>'
SUBSCRIPTION_ID = '<your subscription id>'

credentials = ServicePrincipalCredentials(
    client_id=CLIENT,
    secret=KEY,
    tenant=TENANT_ID
)

Create a PostgreSQL management client object:

client = PostgreSQLManagementClient(
    credentials=credentials,
    subscription_id=SUBSCRIPTION_ID
)

Get the PostgreSQL server you want to enable the “LOG_DURATION” parameter for:

RESOURCE_GROUP_NAME = '<your resource group name>'
SERVER_NAME = '<your server name>'

server = client.servers.get(
    resource_group_name=RESOURCE_GROUP_NAME,
    server_name=SERVER_NAME
)

Update the server configuration to enable the “LOG_DURATION” parameter:

CONFIGURATION_NAME = 'postgresql.conf'
CONFIGURATION_VALUE = 'log_duration = on'

parameters = {
    'name': CONFIGURATION_NAME,
    'value': CONFIGURATION_VALUE
}

client.configurations.create_or_update(
    resource_group_name=RESOURCE_GROUP_NAME,
    server_name=SERVER_NAME,
    configuration_name=CONFIGURATION_NAME,
    parameters=parameters
)

Verify that the configuration has been updated:

configuration = client.configurations.get(
    resource_group_name=RESOURCE_GROUP_NAME,
    server_name=SERVER_NAME,
    configuration_name=CONFIGURATION_NAME
)

print(configuration.value)

This should enable the “LOG_DURATION” parameter for the PostgreSQL server in Azure.

Using Terraform

resource "azurerm_postgresql_server" "POSTGRESQL_SERVER" {
  name                = "POSTGRESQL_SERVER_NAME"          # replace with your server name
  location            = "AZURE_REGION"                    # e.g. "eastus"
  resource_group_name = "RESOURCE_GROUP_NAME"             # replace with your resource group
  sku_name            = "SKU_NAME"                        # e.g. "GP_Gen5_2"
  version             = "11"
  storage_mb          = 5120
  administrator_login          = "ADMIN_USERNAME"
  administrator_login_password = "ADMIN_PASSWORD"

  auto_grow_enabled           = true
  backup_retention_days       = 7
  geo_redundant_backup_enabled = false
  ssl_enforcement_enabled     = true
}

resource "azurerm_postgresql_configuration" "log_duration" {
  name                = "log_duration"
  resource_group_name = azurerm_postgresql_server.POSTGRESQL_SERVER.resource_group_name
  server_name         = azurerm_postgresql_server.POSTGRESQL_SERVER.name
  value               = "on"
}

This change does not replace the PostgreSQL server; it updates a configuration setting in place (a short restart may occur depending on Azure behavior, but Terraform will not recreate the server).After updating your Terraform, terraform plan should show creation (or update) of azurerm_postgresql_configuration.log_duration with value changing from "off" (or unset) to "on" and no destroy/create for the azurerm_postgresql_server.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Azure audit postgressql enable log duration remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation