Skip to content

Enforce encrypted PostgreSQL connections#

Security · Azure Database for PostgreSQL · Rule · 2020_06 · Critical

Enforce encrypted PostgreSQL connections.

Description#

Azure Database for PostgreSQL is configured to only accept encrypted connections by default. When the setting enforce SSL connections is disabled, encrypted and unencrypted connections are permitted. This does not indicate that unencrypted connections are being used.

Unencrypted communication to PostgreSQL server instances could allow disclosure of information to an untrusted party.

Recommendation#

Azure Database for PostgreSQL should be configured to only accept encrypted connections. Unless explicitly required, consider enabling enforce SSL connections.

Also consider using Azure Policy to audit or enforce this configuration.

Comments