> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable In-Transit Encryption for PostgreSQL Database Servers

### More Info:

Ensure that Microsoft Azure PostgreSQL server data is encrypted in transit in order to meet security and compliance requirements. In-transit encryption helps prevent unauthorized users from getting access to critical data available in your Azure PostgreSQL databases.

### Risk Level

High

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AZURE
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* FedRAMP
* HITRUST CSF
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions to remediate the misconfiguration of enabling in-transit encryption for PostgreSQL Database Servers in AZURE:

        1. Go to the AZURE portal and login to your account.
        2. In the left-hand menu, click on the "Azure Database for PostgreSQL servers" option.
        3. Select the PostgreSQL server for which you want to enable in-transit encryption.
        4. In the left-hand menu, under the "Security" section, click on the "Connection security" option.
        5. Under the "Connection security" section, toggle the "Enforce SSL connection" option to "Enabled".
        6. Once you have enabled the "Enforce SSL connection" option, click on the "Save" button at the top of the page to save your changes.

        That's it! You have now remediated the misconfiguration of enabling in-transit encryption for PostgreSQL Database Servers in AZURE. Now, all connections to your PostgreSQL server will be encrypted using SSL.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of enabling In-Transit Encryption for PostgreSQL Database Servers in AZURE using AZURE CLI, you can follow these step-by-step instructions:

        1. Open the Azure CLI in your preferred terminal.

        2. Login to your Azure account using the command below:

           ```
           az login
           ```

        3. Once you are logged in, set the subscription where your PostgreSQL server is located using the command below:

           ```
           az account set --subscription <subscription_name>
           ```

        4. Next, set the resource group where your PostgreSQL server is located using the command below:

           ```
           az group set --name <resource_group_name>
           ```

        5. Now, enable SSL enforcement for your PostgreSQL server using the command below:

           ```
           az postgres server update --resource-group <resource_group_name> --name <postgresql_server_name> --ssl-enforcement Enabled
           ```

           This command will enable SSL enforcement for your PostgreSQL server which will encrypt the data in transit.

        6. Finally, verify that SSL enforcement is enabled for your PostgreSQL server by running the following command:

           ```
           az postgres server show --resource-group <resource_group_name> --name <postgresql_server_name> --query sslEnforcement
           ```

           This command will return the value "Enabled" which confirms that SSL enforcement is enabled for your PostgreSQL server.

        By following these steps, you will be able to remediate the misconfiguration of enabling In-Transit Encryption for PostgreSQL Database Servers in AZURE using AZURE CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Enable In-Transit Encryption for PostgreSQL Database Servers" in Azure using Python, you can follow the below steps:

        1. Import the necessary libraries:

        ```
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.postgresql import PostgreSQLManagementClient
        from azure.mgmt.postgresql.models import ServerUpdateParameters
        ```

        2. Authenticate with Azure using Service Principal credentials:

        ```
        TENANT_ID = 'your_tenant_id'
        CLIENT_ID = 'your_client_id'
        CLIENT_SECRET = 'your_client_secret'
        SUBSCRIPTION_ID = 'your_subscription_id'

        credentials = ServicePrincipalCredentials(
            client_id=CLIENT_ID,
            secret=CLIENT_SECRET,
            tenant=TENANT_ID
        )
        ```

        3. Instantiate the PostgreSQLManagementClient:

        ```
        client = PostgreSQLManagementClient(credentials, SUBSCRIPTION_ID)
        ```

        4. Get the existing server details:

        ```
        resource_group_name = 'your_resource_group_name'
        server_name = 'your_server_name'

        server = client.servers.get(resource_group_name, server_name)
        ```

        5. Update the server with the in-transit encryption enabled:

        ```
        params = ServerUpdateParameters(
            ssl_enforcement="Enabled"
        )

        client.servers.update(resource_group_name, server_name, params)
        ```

        6. Verify that the in-transit encryption is enabled:

        ```
        server = client.servers.get(resource_group_name, server_name)
        print(server.ssl_enforcement)
        ```

        These steps will enable in-transit encryption for PostgreSQL Database Servers in Azure using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_postgresql_server" "POSTGRESQL_SERVER_NAME" {
          name                = "POSTGRESQL_SERVER_NAME"          # replace with your server name
          location            = azurerm_resource_group.RG.name    # replace with your RG reference
          resource_group_name = azurerm_resource_group.RG.name    # replace with your RG
          sku_name            = "GP_Gen5_2"                       # replace with your SKU
          version             = "11"                              # replace with your PostgreSQL version
          administrator_login          = "ADMIN_USERNAME"         # replace
          administrator_login_password = "ADMIN_PASSWORD"         # replace with secure secret reference

          # Enable in-transit encryption (force SSL)
          ssl_enforcement_enabled             = true
          ssl_minimal_tls_version_enforced    = "TLS1_2"

          storage_mb            = 5120
          backup_retention_days = 7
          geo_redundant_backup_enabled = false
          auto_grow_enabled     = true
        }
        ```

        Changing `ssl_enforcement_enabled` and `ssl_minimal_tls_version_enforced` does not force replacement of the server; Terraform will perform an in-place update.

        Verification: `terraform plan` should show the existing `azurerm_postgresql_server` with `ssl_enforcement_enabled` changing from `false` (or `null`) to `true` and `ssl_minimal_tls_version_enforced` changing to `"TLS1_2"`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>