Control: 5.2.3 Ensure server parameter 'connection_throttle.enable' is set to 'ON' for PostgreSQL flexible Server

Description

Enable connection throttling on PostgreSQL flexible servers.

Enabling connection throttling helps the PostgreSQL Database to Set the verbosity of logged messages. This in turn generates query and error logs with respect to concurrent connections that could lead to a successful Denial of Service (DoS) attack by exhausting connection resources. A system can also fail or be degraded by an overload of legitimate users. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.

Remediation

From Azure Portal

Login to Azure Portal using https://portal.azure.com.
Go to Azure Database for PostgreSQL flexible servers.
For each database, under Settings, click Server parameters.
In the filter bar, type connection_throttle.enable.
Set connection_throttle.enable to ON.
Click Save.

From Azure CLI

Use the below command to enable connection_throttle.enable:

az postgres flexible-server parameter set --resource-group <resourceGroup> --server-name <serverName> --name connection_throttle.enable --value on

From PowerShell

Use the below command to update connection_throttling configuration.

Update-AzPostgreSqlFlexibleServerConfiguration -ResourceGroupName <resourceGroup> -ServerName <serverName> -Name connection_throttle.enable -Value on

Default Value

By default, connection_throttle.enable is disabled (set to off).

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v300_5_2_3

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v300_5_2_3 --share

SQL

This control uses a named query:

with connection_throttling_on as(
  select
    id
  from
    azure_postgresql_flexible_server,
    jsonb_array_elements(flexible_server_configurations) as config
  where
    config ->> 'Name' = 'connection_throttle.enable' and config -> 'ConfigurationProperties' ->> 'value' = 'on'
)
select
  s.id as resource,
  case
    when a.id is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when a.id is not null then s.title || ' server parameter connection_throttling on.'
    else s.title || ' server parameter connection_throttling off.'
  end as reason
  
  , s.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_postgresql_flexible_server as s
  left join connection_throttling_on as a on s.id = a.id,
  azure_subscription as sub
where
  sub.subscription_id = s.subscription_id;