> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable Storage Auto-Growth

### More Info:

Ensure that Storage Auto-Growth feature is enabled for your production Azure PostgreSQL database servers. Storage auto-growth prevents your PostgreSQL servers from running out of storage and becoming read-only.

### Risk Level

High

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of not having storage auto-growth enabled in Azure, you can follow these steps:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Navigate to the storage account that you want to remediate.
        3. Click on the "Configuration" tab in the left-hand menu.
        4. Under the "Data Protection" section, click on "Blob Service".
        5. Scroll down to the "Auto-grow" section and toggle the switch to "Enabled".
        6. Specify the maximum size that you want the storage account to grow to. You can either choose a fixed size or enable automatic growth by percentage.
        7. Click "Save" to apply the changes.

        Once you have completed these steps, your storage account will automatically grow as needed to accommodate additional data. This will help prevent any potential data loss due to insufficient storage capacity.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To enable storage auto-growth for Azure using Azure CLI, follow the below steps:

        1. Open the Azure CLI on your local machine or on the Azure portal.

        2. Login to your Azure account using the command:

           ```
           az login
           ```

        3. Select the subscription in which you want to enable storage auto-growth using the command:

           ```
           az account set --subscription <subscription-id>
           ```

        4. Once you have selected the subscription, enable storage auto-growth for the Azure SQL Database using the command:

           ```
           az sql db update --name <database-name> --resource-group <resource-group-name> --service-objective S0 --max-size 250GB --auto-grow true
           ```

           In the above command, replace the `<database-name>` with the name of the database for which you want to enable storage auto-growth, `<resource-group-name>` with the name of the resource group in which the database is present.

           The `--max-size` parameter specifies the maximum size of the database and the `--auto-grow` parameter enables the storage auto-growth for the database.

        5. Once the command is executed successfully, you will receive a confirmation message.

           ```
           {
             "autoPauseDelay": null,
             "catalogCollation": "SQL_Latin1_General_CP1_CI_AS",
             "collation": "SQL_Latin1_General_CP1_CI_AS",
             "createMode": null,
             "creationDate": "2021-09-23T11:53:25.06Z",
             "currentServiceObjectiveName": "S0",
             "databaseId": "1f3a2a2a-7f36-4e7b-9d9d-4c6b6d5f9e3c",
             "defaultSecondaryLocation": null,
             "earliestRestoreDate": null,
             "edition": "Standard",
             "elasticPoolId": null,
             "failoverGroupId": null,
             "id": "/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/xxxxx/providers/Microsoft.Sql/servers/xxxxx/databases/xxxxx",
             "kind": "v12.0,user",
             "location": "eastus",
             "longTermRetentionBackupResourceId": null,
             "maxLogSizeBytes": null,
             "maxSizeBytes": "268435456000",
             "name": "xxxxx",
             "readScale": null,
             "recoverableDatabaseId": null,
             "recoveryServicesRecoveryPointResourceId": null,
             "requestedServiceObjectiveName": null,
             "resourceGroup": "xxxxx",
             "restorableDroppedDatabaseId": null,
             "restorePointInTime": null,
             "sampleName": null,
             "serviceLevelObjective": "S0",
             "sourceDatabaseDeletionDate": null,
             "sourceDatabaseId": null,
             "status": "Online",
             "tags": {},
             "type": "Microsoft.Sql/servers/databases",
             "zoneRedundant": false
           }
           ```

           This confirms that storage auto-growth has been enabled for the Azure SQL Database.
      </Accordion>

      <Accordion title="Using Python">
        To enable storage auto-growth in Azure using Python, you can use the Azure SDK for Python. Here are the steps to remediate this issue:

        1. Install the Azure SDK for Python:

        ```
        pip install azure-mgmt-storage
        ```

        2. Import the necessary modules:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.storage import StorageManagementClient
        ```

        3. Authenticate with Azure using Service Principal credentials:

        ```python theme={null}
        TENANT_ID = '<your tenant id>'
        CLIENT_ID = '<your client id>'
        CLIENT_SECRET = '<your client secret>'
        SUBSCRIPTION_ID = '<your subscription id>'

        credentials = ServicePrincipalCredentials(
            client_id=CLIENT_ID,
            secret=CLIENT_SECRET,
            tenant=TENANT_ID
        )
        ```

        4. Create a StorageManagementClient object:

        ```python theme={null}
        storage_client = StorageManagementClient(
            credentials=credentials,
            subscription_id=SUBSCRIPTION_ID
        )
        ```

        5. Get the storage account that needs to be remediated:

        ```python theme={null}
        RESOURCE_GROUP_NAME = '<your resource group name>'
        ACCOUNT_NAME = '<your storage account name>'

        storage_account = storage_client.storage_accounts.get_properties(
            RESOURCE_GROUP_NAME,
            ACCOUNT_NAME
        )
        ```

        6. Enable storage auto-growth by updating the storage account:

        ```python theme={null}
        storage_account.auto_grow_enabled = True

        storage_client.storage_accounts.update(
            RESOURCE_GROUP_NAME,
            ACCOUNT_NAME,
            storage_account
        )
        ```

        This will enable storage auto-growth for the specified storage account in Azure.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_postgresql_server" "POSTGRESQL_SERVER" {
          name                = "POSTGRESQL_SERVER_NAME"
          location            = azurerm_resource_group.RG.name
          resource_group_name = azurerm_resource_group.RG.name

          sku_name = "GP_Gen5_4" # CHANGE to your SKU

          administrator_login          = "ADMIN_USERNAME"
          administrator_login_password = "ADMIN_PASSWORD"

          version                          = "11"
          ssl_enforcement_enabled          = true
          public_network_access_enabled    = true
          auto_grow_enabled                = true  # Enable Storage Auto-Growth
          storage_mb                       = 51200 # CHANGE to your current/desired storage size in MB
          backup_retention_days            = 7
          geo_redundant_backup_enabled     = false

          tags = {
            Environment = "production"
          }
        }
        ```

        Note: Enabling `auto_grow_enabled = true` is an in-place update and should not force replacement of the PostgreSQL server.

        To verify, `terraform plan` should show an update to `azurerm_postgresql_server.POSTGRESQL_SERVER` with `auto_grow_enabled` changing from `false` (or `null`) to `true`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>