Flexible PostgreSQL server has connection_throttling enabled

Check ID: postgresql_flexible_server_connection_throttling_on
Provider: Azure
Service: postgresql
Severity: MEDIUM
Categories: logging
Resource type: microsoft.dbforpostgresql/flexibleservers

What this check verifies

Azure PostgreSQL flexible servers where the connection_throttling parameter is set to ON

Risk

Without connection_throttling, bursts of new sessions can exhaust connection slots and CPU, degrading availability and causing timeouts. Reduced telemetry delays detection of DoS or runaway clients, extending impact and recovery time.

Recommendation

Enable connection_throttling and align connection limits with expected load. Apply defense in depth: use connection pooling, exponential backoff, and alerts on connection spikes; prefer private access and restrictive networking to reduce exposure.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az postgres flexible-server parameter set —resource-group <resourceGroupName> —server-name <serverName> —name connection_throttle.enable —value on

resource "azurerm_postgresql_flexible_server_configuration" "<example_resource_name>" {
  name      = "connection_throttle.enable"
  server_id = "<example_resource_id>"
  value     = "on" # CRITICAL: Enables connection_throttle.enable to pass the check
}

// Configure an existing Flexible Server parameter
resource exampleServer 'Microsoft.DBforPostgreSQL/flexibleServers@2022-12-01' existing = {
  name: '<example_resource_name>'
}

resource connectionThrottling 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2022-12-01' = {
  name: 'connection_throttle.enable'
  parent: exampleServer
  properties: {
    value: 'on' // CRITICAL: Enables connection_throttle.enable to pass the check
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = postgresql_flexible_server_connection_throttling_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

PostgreSQL flexible server blocks all Azure service access PostgreSQL Flexible Server enforces SSL connections

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires