> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit postgressql enable log connections remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To enable the "LOG\_CONNECTIONS" parameter for PostgreSQL servers in Azure, please follow the below steps:

        1. Login to Azure portal ([https://portal.azure.com/](https://portal.azure.com/))
        2. Navigate to the PostgreSQL server for which you want to enable the parameter.
        3. In the left-hand menu, click on "Settings".
        4. Under the "Settings" tab, click on the "Configuration" option.
        5. Under the "Parameters" tab, search for the "logging\_collector" parameter.
        6. Set the value of "logging\_collector" parameter to "on".
        7. Search for the "log\_connections" parameter.
        8. Set the value of "log\_connections" parameter to "on".
        9. Click on the "Save" button to save the changes.

        Once you have followed these steps, the "LOG\_CONNECTIONS" parameter will be enabled for your PostgreSQL server in Azure.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To enable the "LOG\_CONNECTIONS" parameter for PostgreSQL servers in Azure using Azure CLI, follow these steps:

        1. Open the Azure CLI in your terminal or command prompt.

        2. Log in to your Azure account using the command:

           ```
           az login
           ```

        3. Once logged in, select the Azure subscription where your PostgreSQL server is located using the command:

           ```
           az account set --subscription <subscription-id>
           ```

        4. Next, retrieve the resource ID of your PostgreSQL server using the command:

           ```
           az postgres server show --resource-group <resource-group-name> --name <server-name> --query id --output tsv
           ```

           Replace `<resource-group-name>` with the name of the resource group where your PostgreSQL server is located, and `<server-name>` with the name of your PostgreSQL server.

        5. Once you have the resource ID, use the following command to enable the "LOG\_CONNECTIONS" parameter:

           ```
           az postgres server configuration set --resource-group <resource-group-name> --server-name <server-name> --name log_connections --value on
           ```

           Replace `<resource-group-name>` with the name of the resource group where your PostgreSQL server is located, and `<server-name>` with the name of your PostgreSQL server.

        6. After executing the command, the "LOG\_CONNECTIONS" parameter will be enabled for your PostgreSQL server. You can verify this by checking the server configuration using the command:

           ```
           az postgres server configuration show --resource-group <resource-group-name> --server-name <server-name> --name log_connections
           ```

           Replace `<resource-group-name>` with the name of the resource group where your PostgreSQL server is located, and `<server-name>` with the name of your PostgreSQL server.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Enable 'LOG\_CONNECTIONS' Parameter for PostgreSQL Servers" in Azure using Python, you can follow these steps:

        1. First, you need to authenticate and create a PostgreSQL server object using the Azure Python SDK. You can use the following code snippet to achieve this:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.rdbms.postgresql import PostgreSQLManagementClient
        from azure.mgmt.rdbms.postgresql.models import ServerUpdateParameters

        # Replace the values in <> with your Azure credentials and PostgreSQL server details
        credentials = ServicePrincipalCredentials(
            client_id='<client_id>',
            secret='<client_secret>',
            tenant='<tenant_id>'
        )

        client = PostgreSQLManagementClient(
            credentials,
            '<subscription_id>'
        )

        server_name = '<server_name>'
        resource_group_name = '<resource_group_name>'

        server = client.servers.get(resource_group_name, server_name)
        ```

        2. Once you have the server object, you can update the server parameters to enable the "log\_connections" parameter. You can use the following code snippet to achieve this:

        ```python theme={null}
        # Update the server parameters to enable log_connections
        parameters = ServerUpdateParameters(
            parameters={
                'log_connections': 'on'
            }
        )

        client.servers.update(
            resource_group_name,
            server_name,
            parameters
        )
        ```

        3. Finally, you can verify that the parameter has been updated by checking the server parameters. You can use the following code snippet to achieve this:

        ```python theme={null}
        # Get the server parameters and check if log_connections is enabled
        server_parameters = client.servers.list_by_resource_group(resource_group_name)

        for parameter in server_parameters:
            if parameter.name == server_name:
                print(parameter.parameters.log_connections)
        ```

        This code will print "on" if the "log\_connections" parameter has been successfully enabled.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_postgresql_server" "this" {
          name                = "POSTGRESQL_SERVER_NAME"          # replace with your server name
          resource_group_name = "RESOURCE_GROUP_NAME"             # replace with your RG name
          location            = "AZURE_REGION"                    # e.g. "eastus"

          sku_name   = "B_Gen5_1"                                 # replace with desired SKU
          version    = "11"                                       # replace with your engine version
          storage_mb = 51200

          administrator_login          = "ADMIN_USERNAME"         # replace
          administrator_login_password = "ADMIN_PASSWORD"         # replace (use sensitive input)

          backup_retention_days        = 7
          geo_redundant_backup_enabled = false
          auto_grow_enabled            = true
          public_network_access_enabled = true

          ssl_enforcement_enabled = true
        }

        resource "azurerm_postgresql_configuration" "log_connections" {
          name                = "log_connections"
          resource_group_name = azurerm_postgresql_server.this.resource_group_name
          server_name         = azurerm_postgresql_server.this.name
          value               = "on"
        }
        ```

        This change does not force replacement of the PostgreSQL server; it updates the `log_connections` configuration in place on the existing server.

        For verification, `terraform plan` should show creation (or update) of `azurerm_postgresql_configuration.log_connections` with `name = "log_connections"` and `value = "on"` and no `destroy`/`replace` of `azurerm_postgresql_server.this`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>