PostgreSQL Flexible Server enforces SSL connections

Check ID: postgresql_flexible_server_enforce_ssl_enabled
Provider: Azure
Service: postgresql
Severity: HIGH
Categories: encryption
Resource type: microsoft.dbforpostgresql/flexibleservers

What this check verifies

Azure Database for PostgreSQL flexible servers are evaluated for encrypted in-transit connections, specifically whether require_secure_transport is set to ON to force TLS for all client sessions.

Risk

Without enforced TLS, clients may connect in plaintext or with weak settings, exposing credentials and data to man-in-the-middle, query tampering, and session hijacking. This undermines confidentiality and integrity, and can enable lateral movement if stolen creds are reused.

Recommendation

Enforce encryption in transit: set require_secure_transport=ON, prefer TLS 1.3 (or at least ssl_min_protocol_version=1.2), and require clients to verify server identity. Disable mixed modes, rotate certificates, and restrict access via private endpoints to apply defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az postgres flexible-server parameter set —resource-group <RESOURCE_GROUP> —server-name <SERVER_NAME> —name require_secure_transport —value ON

# Enable SSL/TLS enforcement on a PostgreSQL Flexible Server
resource "azurerm_postgresql_flexible_server_configuration" "<example_resource_name>" {
  name      = "require_secure_transport"   # CRITICAL: Target the SSL enforcement parameter
  server_id = "<example_resource_id>"      # ID of the target flexible server
  value     = "ON"                          # CRITICAL: Enforce SSL/TLS
}

// Enable SSL/TLS enforcement on an existing PostgreSQL Flexible Server
resource server 'Microsoft.DBforPostgreSQL/flexibleServers@2023-12-01' existing = {
  name: '<example_resource_name>'
}

resource requireSecureTransport 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2023-12-01' = {
  name: '${server.name}/require_secure_transport'
  properties: {
    value: 'ON' // CRITICAL: Enforces SSL/TLS by turning require_secure_transport ON
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = postgresql_flexible_server_enforce_ssl_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Flexible PostgreSQL server has connection_throttling enabled PostgreSQL Flexible Server has Entra ID authentication

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires