PostgreSQL flexible server retains logs 4 to 7 days

Check ID: postgresql_flexible_server_log_retention_days_greater_3
Provider: Azure
Service: postgresql
Severity: MEDIUM
Categories: logging
Resource type: microsoft.dbforpostgresql/flexibleservers

What this check verifies

Log retention on Azure Database for PostgreSQL Flexible Server is governed by log_retention_days. Configuration is assessed as set and within 4-7 days versus unset or outside this range.

Risk

Insufficient or disabled log retention limits the audit trail needed to detect brute-force, SQL injection, or insider misuse, impeding investigation. Excessive retention enlarges exposure if logs are accessed, risking sensitive query data leakage and policy violations. This reduces visibility and weakens confidentiality and integrity.

Recommendation

Set log_retention_days to 4-7 to balance visibility and exposure. Export logs to centralized SIEM or secure storage for longer retention and analysis. Enforce least privilege, encryption, and immutability on log data, and monitor for gaps. Apply defense in depth with alerts on anomalous queries and failed logins.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az postgres flexible-server parameter set —resource-group <RESOURCE_GROUP> —server-name <SERVER_NAME> —name logfiles.retention_days —value 7

resource "azurerm_postgresql_flexible_server_configuration" "<example_resource_name>" {
  server_id = "<example_resource_id>"
  name      = "logfiles.retention_days"
  value     = "7" # Critical: sets retention within 4-7 to pass the check
}

// Set log retention to a compliant value (4-7 days) for an existing Flexible Server
resource cfg 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2023-03-01-preview' = {
  name: '<example_resource_name>/logfiles.retention_days'
  properties: {
    value: '7' // Critical: sets logfiles.retention_days within 4-7 to pass the check
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = postgresql_flexible_server_log_retention_days_greater_3. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

PostgreSQL Flexible Server has disconnection logging enabled SQL Server has an auditing policy configured

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires