> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit postgresql enable geo redundant backup remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of not having Geo-Redundant Backups enabled in Azure, follow these step-by-step instructions:

        1. Log in to the Azure portal at [https://portal.azure.com/](https://portal.azure.com/).
        2. Navigate to the resource group that contains the storage account you want to remediate.
        3. Select the storage account from the list of resources.
        4. In the left-hand menu, click on "Backup".
        5. In the "Backup" menu, click on "Backup policy".
        6. Click on "Edit".
        7. In the "Policy details" section, select "Geo-redundant" from the "Replication" drop-down menu.
        8. Click on "Save".

        After completing these steps, Geo-Redundant Backups will be enabled for the selected storage account. It is recommended to regularly review and update backup policies to ensure that they align with your business continuity and disaster recovery requirements.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of not having Geo-Redundant Backups enabled in Azure using Azure CLI, you can follow these steps:

        1. Open the Azure CLI command prompt or terminal.

        2. Login to your Azure account using the command:

           ```
           az login
           ```

        3. Once you are logged in, set the target subscription using the command:

           ```
           az account set --subscription <subscription_id>
           ```

        4. Next, enable Geo-Redundant Backups for the desired resource group using the command:

           ```
           az backup vault backup-properties set --backup-management-type AzureIaasVM --resource-group <resource_group_name> --vault-name <vault_name> --backup-storage-redundancy GeoRedundant
           ```

           Here, replace `<resource_group_name>` with the name of the resource group where the backup vault is located and `<vault_name>` with the name of the backup vault.

        5. Verify the backup properties using the command:

           ```
           az backup vault backup-properties show --backup-management-type AzureIaasVM --resource-group <resource_group_name> --vault-name <vault_name>
           ```

           This command will display the backup properties for the specified backup vault.

        6. Once you have verified that Geo-Redundant Backups have been enabled, you can exit the Azure CLI using the command:

           ```
           exit
           ```

        With these steps, you should be able to remediate the misconfiguration of not having Geo-Redundant Backups enabled in Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of not having Geo-Redundant Backups enabled in Azure using Python, you can use the Azure SDK for Python. Here are the step-by-step instructions:

        1. Install the Azure SDK for Python using pip:

        ```python theme={null}
        pip install azure-mgmt-recoveryservicesbackup
        ```

        2. Import the necessary modules:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.recoveryservicesbackup import RecoveryServicesBackupClient
        from azure.mgmt.recoveryservicesbackup.models import ProtectionIntent
        ```

        3. Set up the authentication credentials using a service principal:

        ```python theme={null}
        credentials = ServicePrincipalCredentials(
            client_id='<client_id>',
            secret='<client_secret>',
            tenant='<tenant_id>'
        )
        ```

        4. Instantiate the `RecoveryServicesBackupClient` using the authentication credentials:

        ```python theme={null}
        client = RecoveryServicesBackupClient(credentials, '<subscription_id>')
        ```

        5. Get the list of protection intents:

        ```python theme={null}
        protection_intents = client.protection_intents.list()
        ```

        6. Check if Geo-Redundant Backups are enabled for each protection intent:

        ```python theme={null}
        for protection_intent in protection_intents:
            if protection_intent.properties.backup_management_type == 'AzureIaasVM':
                if not protection_intent.properties.is_geo_redundant:
                    # Enable Geo-Redundant Backups
                    protection_intent.properties.is_geo_redundant = True
                    client.protection_intents.create_or_update(
                        protection_intent.name,
                        protection_intent
                    )
        ```

        7. Save the changes by calling `create_or_update` on each protection intent that had Geo-Redundant Backups enabled.

        That's it! With these steps, you can remediate the misconfiguration of not having Geo-Redundant Backups enabled in Azure using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_postgresql_server" "postgres" {
          name                = "POSTGRES_SERVER_NAME"
          resource_group_name = azurerm_resource_group.rg.name
          location            = azurerm_resource_group.rg.location

          sku_name   = "SKU_NAME"          # e.g. "GP_Gen5_4"
          version    = "POSTGRES_VERSION"  # e.g. "11"
          storage_mb = 51200

          administrator_login          = "ADMIN_USERNAME"
          administrator_login_password = "ADMIN_PASSWORD"

          # Enable geo-redundant backups
          # NOTE: Changing this value forces replacement of the PostgreSQL server.
          geo_redundant_backup_enabled = true

          backup_retention_days = 7

          auto_grow_enabled            = true
          ssl_enforcement_enabled      = true
          public_network_access_enabled = true

          tags = {
            Environment = "ENVIRONMENT_TAG"
          }
        }
        ```

        Replace:

        * `POSTGRES_SERVER_NAME` with your server name.
        * `SKU_NAME` with the desired SKU.
        * `POSTGRES_VERSION` with your PostgreSQL version.
        * `ADMIN_USERNAME` / `ADMIN_PASSWORD` with your admin credentials.
        * `ENVIRONMENT_TAG` with your environment label.

        Enabling `geo_redundant_backup_enabled = true` will force recreation of the PostgreSQL server and its data; plan for downtime and data migration accordingly.

        Verification: `terraform plan` should show `geo_redundant_backup_enabled` changing from `false` (or `null`) to `true` with `-/+` indicating the server will be destroyed and re-created.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>