Skip to main content

Azure Enable Geo-Redundant Backups

More Info:​

Ensure that your Microsoft Azure PostgreSQL database servers have geo-redundant backups enabled, to allow you to restore your PostgreSQL servers to a different Azure region in the event of a regional outage or a disaster.

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HITRUST CSF
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of not having Geo-Redundant Backups enabled in Azure, follow these step-by-step instructions:

  1. Log in to the Azure portal at https://portal.azure.com/.
  2. Navigate to the resource group that contains the storage account you want to remediate.
  3. Select the storage account from the list of resources.
  4. In the left-hand menu, click on "Backup".
  5. In the "Backup" menu, click on "Backup policy".
  6. Click on "Edit".
  7. In the "Policy details" section, select "Geo-redundant" from the "Replication" drop-down menu.
  8. Click on "Save".

After completing these steps, Geo-Redundant Backups will be enabled for the selected storage account. It is recommended to regularly review and update backup policies to ensure that they align with your business continuity and disaster recovery requirements.

Using CLI

To remediate the misconfiguration of not having Geo-Redundant Backups enabled in Azure using Azure CLI, you can follow these steps:

  1. Open the Azure CLI command prompt or terminal.

  2. Login to your Azure account using the command:

    az login

  3. Once you are logged in, set the target subscription using the command:

    az account set --subscription <subscription_id>

  4. Next, enable Geo-Redundant Backups for the desired resource group using the command:

    az backup vault backup-properties set --backup-management-type AzureIaasVM --resource-group <resource_group_name> --vault-name <vault_name> --backup-storage-redundancy GeoRedundant

    Here, replace <resource_group_name> with the name of the resource group where the backup vault is located and <vault_name> with the name of the backup vault.

  5. Verify the backup properties using the command:

    az backup vault backup-properties show --backup-management-type AzureIaasVM --resource-group <resource_group_name> --vault-name <vault_name>

    This command will display the backup properties for the specified backup vault.

  6. Once you have verified that Geo-Redundant Backups have been enabled, you can exit the Azure CLI using the command:

    exit

With these steps, you should be able to remediate the misconfiguration of not having Geo-Redundant Backups enabled in Azure using Azure CLI.

Using Python

To remediate the misconfiguration of not having Geo-Redundant Backups enabled in Azure using Python, you can use the Azure SDK for Python. Here are the step-by-step instructions:

  1. Install the Azure SDK for Python using pip:
pip install azure-mgmt-recoveryservicesbackup
  1. Import the necessary modules:
from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.recoveryservicesbackup import RecoveryServicesBackupClient
from azure.mgmt.recoveryservicesbackup.models import ProtectionIntent
  1. Set up the authentication credentials using a service principal:
credentials = ServicePrincipalCredentials(
    client_id='<client_id>',
    secret='<client_secret>',
    tenant='<tenant_id>'
)
  1. Instantiate the RecoveryServicesBackupClient using the authentication credentials:
client = RecoveryServicesBackupClient(credentials, '<subscription_id>')
  1. Get the list of protection intents:
protection_intents = client.protection_intents.list()
  1. Check if Geo-Redundant Backups are enabled for each protection intent:
for protection_intent in protection_intents:
    if protection_intent.properties.backup_management_type == 'AzureIaasVM':
        if not protection_intent.properties.is_geo_redundant:
            # Enable Geo-Redundant Backups
            protection_intent.properties.is_geo_redundant = True
            client.protection_intents.create_or_update(
                protection_intent.name,
                protection_intent
            )
  1. Save the changes by calling create_or_update on each protection intent that had Geo-Redundant Backups enabled.

That's it! With these steps, you can remediate the misconfiguration of not having Geo-Redundant Backups enabled in Azure using Python.

Using Terraform
resource "azurerm_postgresql_server" "postgres" {
  name                = "POSTGRES_SERVER_NAME"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location

  sku_name   = "SKU_NAME"          # e.g. "GP_Gen5_4"
  version    = "POSTGRES_VERSION"  # e.g. "11"
  storage_mb = 51200

  administrator_login          = "ADMIN_USERNAME"
  administrator_login_password = "ADMIN_PASSWORD"

  # Enable geo-redundant backups
  # NOTE: Changing this value forces replacement of the PostgreSQL server.
  geo_redundant_backup_enabled = true

  backup_retention_days = 7

  auto_grow_enabled            = true
  ssl_enforcement_enabled      = true
  public_network_access_enabled = true

  tags = {
    Environment = "ENVIRONMENT_TAG"
  }
}

Replace:

  • POSTGRES_SERVER_NAME with your server name.
  • SKU_NAME with the desired SKU.
  • POSTGRES_VERSION with your PostgreSQL version.
  • ADMIN_USERNAME / ADMIN_PASSWORD with your admin credentials.
  • ENVIRONMENT_TAG with your environment label.

Enabling geo_redundant_backup_enabled = true will force recreation of the PostgreSQL server and its data; plan for downtime and data migration accordingly.

Verification: terraform plan should show geo_redundant_backup_enabled changing from false (or null) to true with -/+ indicating the server will be destroyed and re-created.