> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable LOG_CONNECTIONS Parameter for PostgreSQL Servers

### More Info:

Ensure that log\_connections server parameter is enabled for all PostgreSQL database servers available in your Microsoft Azure cloud account. The log\_connections parameter allows each attempted connection to the database server to be logged, including successful client authentication requests. Only Azure users with administrative privileges can change this parameter at session start, and it cannot be changed during an access session.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS AZURE
* Cloudanix Best Practice
* HITRUST CSF
* NIST CSF
* PCI
* SOC2

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To enable the "LOG\_CONNECTIONS" parameter for PostgreSQL servers in Azure, please follow the below steps:

        1. Login to Azure portal ([https://portal.azure.com/](https://portal.azure.com/))
        2. Navigate to the PostgreSQL server for which you want to enable the parameter.
        3. In the left-hand menu, click on "Settings".
        4. Under the "Settings" tab, click on the "Configuration" option.
        5. Under the "Parameters" tab, search for the "logging\_collector" parameter.
        6. Set the value of "logging\_collector" parameter to "on".
        7. Search for the "log\_connections" parameter.
        8. Set the value of "log\_connections" parameter to "on".
        9. Click on the "Save" button to save the changes.

        Once you have followed these steps, the "LOG\_CONNECTIONS" parameter will be enabled for your PostgreSQL server in Azure.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To enable the "LOG\_CONNECTIONS" parameter for PostgreSQL servers in Azure using Azure CLI, follow these steps:

        1. Open the Azure CLI in your terminal or command prompt.

        2. Log in to your Azure account using the command:

           ```
           az login
           ```

        3. Once logged in, select the Azure subscription where your PostgreSQL server is located using the command:

           ```
           az account set --subscription <subscription-id>
           ```

        4. Next, retrieve the resource ID of your PostgreSQL server using the command:

           ```
           az postgres server show --resource-group <resource-group-name> --name <server-name> --query id --output tsv
           ```

           Replace `<resource-group-name>` with the name of the resource group where your PostgreSQL server is located, and `<server-name>` with the name of your PostgreSQL server.

        5. Once you have the resource ID, use the following command to enable the "LOG\_CONNECTIONS" parameter:

           ```
           az postgres server configuration set --resource-group <resource-group-name> --server-name <server-name> --name log_connections --value on
           ```

           Replace `<resource-group-name>` with the name of the resource group where your PostgreSQL server is located, and `<server-name>` with the name of your PostgreSQL server.

        6. After executing the command, the "LOG\_CONNECTIONS" parameter will be enabled for your PostgreSQL server. You can verify this by checking the server configuration using the command:

           ```
           az postgres server configuration show --resource-group <resource-group-name> --server-name <server-name> --name log_connections
           ```

           Replace `<resource-group-name>` with the name of the resource group where your PostgreSQL server is located, and `<server-name>` with the name of your PostgreSQL server.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Enable 'LOG\_CONNECTIONS' Parameter for PostgreSQL Servers" in Azure using Python, you can follow these steps:

        1. First, you need to authenticate and create a PostgreSQL server object using the Azure Python SDK. You can use the following code snippet to achieve this:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.rdbms.postgresql import PostgreSQLManagementClient
        from azure.mgmt.rdbms.postgresql.models import ServerUpdateParameters

        # Replace the values in <> with your Azure credentials and PostgreSQL server details
        credentials = ServicePrincipalCredentials(
            client_id='<client_id>',
            secret='<client_secret>',
            tenant='<tenant_id>'
        )

        client = PostgreSQLManagementClient(
            credentials,
            '<subscription_id>'
        )

        server_name = '<server_name>'
        resource_group_name = '<resource_group_name>'

        server = client.servers.get(resource_group_name, server_name)
        ```

        2. Once you have the server object, you can update the server parameters to enable the "log\_connections" parameter. You can use the following code snippet to achieve this:

        ```python theme={null}
        # Update the server parameters to enable log_connections
        parameters = ServerUpdateParameters(
            parameters={
                'log_connections': 'on'
            }
        )

        client.servers.update(
            resource_group_name,
            server_name,
            parameters
        )
        ```

        3. Finally, you can verify that the parameter has been updated by checking the server parameters. You can use the following code snippet to achieve this:

        ```python theme={null}
        # Get the server parameters and check if log_connections is enabled
        server_parameters = client.servers.list_by_resource_group(resource_group_name)

        for parameter in server_parameters:
            if parameter.name == server_name:
                print(parameter.parameters.log_connections)
        ```

        This code will print "on" if the "log\_connections" parameter has been successfully enabled.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_postgresql_server" "this" {
          name                = "POSTGRESQL_SERVER_NAME"          # replace with your server name
          resource_group_name = "RESOURCE_GROUP_NAME"             # replace with your RG name
          location            = "AZURE_REGION"                    # e.g. "eastus"

          sku_name   = "B_Gen5_1"                                 # replace with desired SKU
          version    = "11"                                       # replace with your engine version
          storage_mb = 51200

          administrator_login          = "ADMIN_USERNAME"         # replace
          administrator_login_password = "ADMIN_PASSWORD"         # replace (use sensitive input)

          backup_retention_days        = 7
          geo_redundant_backup_enabled = false
          auto_grow_enabled            = true
          public_network_access_enabled = true

          ssl_enforcement_enabled = true
        }

        resource "azurerm_postgresql_configuration" "log_connections" {
          name                = "log_connections"
          resource_group_name = azurerm_postgresql_server.this.resource_group_name
          server_name         = azurerm_postgresql_server.this.name
          value               = "on"
        }
        ```

        This change does not force replacement of the PostgreSQL server; it updates the `log_connections` configuration in place on the existing server.

        For verification, `terraform plan` should show creation (or update) of `azurerm_postgresql_configuration.log_connections` with `name = "log_connections"` and `value = "on"` and no `destroy`/`replace` of `azurerm_postgresql_server.this`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>