> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit postgresql log retention period remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, I can provide you with the steps to remediate PostgreSQL Log Retention Period misconfiguration in Azure using the Azure console. Here are the steps:

        1. Login to the Azure portal and navigate to the Azure Database for PostgreSQL service.

        2. Select the PostgreSQL server for which you want to remediate the Log Retention Period misconfiguration.

        3. In the left-hand menu, select "Configuration".

        4. Scroll down to the "Logging" section and locate the "retention\_days" parameter.

        5. Update the value of "retention\_days" to the desired log retention period (in days).

        6. Click the "Save" button to save the changes.

        7. Verify the changes by checking the "Overview" page of the PostgreSQL server and ensuring that the new retention period is reflected.

        That's it! You have successfully remediated the PostgreSQL Log Retention Period misconfiguration in Azure using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        Sure, here are the step-by-step instructions to remediate the PostgreSQL Log Retention Period misconfiguration in Azure using Azure CLI:

        1. Open the Azure CLI and log in to your Azure account.

        2. Run the following command to set the retention period for logs in your PostgreSQL database:

           ```
           az postgres server-logs retention update --days <number_of_days> --resource-group <resource_group_name> --server-name <server_name>
           ```

           Replace `<number_of_days>` with the number of days for which you want to retain the logs, `<resource_group_name>` with the name of the resource group containing your PostgreSQL server, and `<server_name>` with the name of your PostgreSQL server.

           For example, to set the retention period to 30 days for a PostgreSQL server named "myserver" in a resource group named "myresourcegroup", run the following command:

           ```
           az postgres server-logs retention update --days 30 --resource-group myresourcegroup --server-name myserver
           ```

        3. Once the command is executed successfully, the retention period for logs in your PostgreSQL database will be updated to the specified number of days.

        That's it! By following these simple steps, you can remediate the PostgreSQL Log Retention Period misconfiguration in Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the PostgreSQL Log Retention Period misconfiguration in Azure using Python, you can follow these steps:

        1. Import the necessary libraries:

        ```
        from azure.identity import DefaultAzureCredential
        from azure.mgmt.rdbms import postgresql
        ```

        2. Set the subscription ID, resource group name, server name, and database name:

        ```
        subscription_id = 'your-subscription-id'
        resource_group_name = 'your-resource-group-name'
        server_name = 'your-server-name'
        database_name = 'your-database-name'
        ```

        3. Create a credential object to authenticate with Azure:

        ```
        credential = DefaultAzureCredential()
        ```

        4. Create a PostgreSQLManagementClient object:

        ```
        client = postgresql.PostgreSQLManagementClient(credential, subscription_id)
        ```

        5. Get the current log retention period:

        ```
        log_retention_days = client.configurations.list_by_server(resource_group_name, server_name, database_name, 'postgresqlconf').as_dict().get('log_retention_days')
        ```

        6. If the log retention period is set to a value greater than 7 days, update the configuration:

        ```
        if log_retention_days > 7:
            client.configurations.create_or_update(resource_group_name, server_name, database_name, 'postgresqlconf', {'log_retention_days': 7})
        ```

        This will update the PostgreSQL log retention period to 7 days if it is currently set to a value greater than 7 days.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_postgresql_server" "POSTGRES_SERVER" {
          name                = "REPLACE_WITH_SERVER_NAME"
          location            = azurerm_resource_group.RG.location
          resource_group_name = azurerm_resource_group.RG.name

          sku_name = "REPLACE_WITH_SKU_NAME"

          storage_mb                   = 5120
          version                      = "REPLACE_WITH_POSTGRES_VERSION"
          administrator_login          = "REPLACE_WITH_ADMIN_LOGIN"
          administrator_login_password = "REPLACE_WITH_ADMIN_PASSWORD"

          auto_grow_enabled                 = true
          backup_retention_days             = 7
          geo_redundant_backup_enabled      = false
          public_network_access_enabled     = true
          ssl_enforcement_enabled           = true
          ssl_minimal_tls_version_enforced  = "TLS1_2"
        }

        resource "azurerm_postgresql_configuration" "log_retention_days" {
          name                = "log_retention_days"
          resource_group_name = azurerm_postgresql_server.POSTGRES_SERVER.resource_group_name
          server_name         = azurerm_postgresql_server.POSTGRES_SERVER.name

          # Compliant range is 4–7; pick the exact value you require
          value = "REPLACE_WITH_VALUE_BETWEEN_4_AND_7"
        }
        ```

        This change does not force replacement of the PostgreSQL server; it updates the configuration in place.

        To verify, `terraform plan` should show an update to `azurerm_postgresql_configuration.log_retention_days.value` from its current value to your chosen value between 4 and 7.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>