PostgreSQL server without connection throttling

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: terraform-azure-postgresql-server-without-connection-throttling

Provider: Azure

Platform: Terraform

Severity: Medium

Category: Observability

Learn More

Description

PostgreSQL servers should have connection throttling enabled by setting the connection_throttling configuration value to "on". Without connection throttling (for example, value = "off"), the server is more vulnerable to connection floods and denial-of-service attacks, as there is no mechanism to limit the rate of incoming connections. Enabling this option reduces the risk of service disruption by preventing excessive connection attempts from overloading the database.

A secure Terraform configuration example is shown below:

resource "azurerm_postgresql_configuration" "example" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "on"
}

Compliant Code Examples

resource "azurerm_postgresql_configuration" "negative1" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "on"
}

resource "azurerm_postgresql_configuration" "negative2" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "On"
}

resource "azurerm_postgresql_configuration" "negative3" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "ON"
}

resource "azurerm_resource_group" "example2" {
  name     = "example2-rg"
  location = "eastus"
}

resource "azurerm_postgresql_flexible_server" "example2" {
  name                   = "example2-flexibleserver"
  resource_group_name    = azurerm_resource_group.example2.name
  location               = azurerm_resource_group.example2.location
  version                = "13"
  administrator_login    = "psqladmin"
  administrator_password = "H@Sh1CoR3!"
  storage_mb             = 32768
  sku_name               = "B_Standard_B1ms"
}

resource "azurerm_postgresql_flexible_server_configuration" "negative4" {
  name      = "connection_throttle.enable"
  server_id = azurerm_postgresql_flexible_server.example2.id
  value     = "on"
}

Non-Compliant Code Examples

resource "azurerm_postgresql_configuration" "positive1" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "off"
}

resource "azurerm_postgresql_configuration" "positive2" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "Off"
}

resource "azurerm_postgresql_configuration" "positive3" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "OFF"
}

resource "azurerm_resource_group" "example2" {
  name     = "example2-rg"
  location = "eastus"
}

resource "azurerm_postgresql_flexible_server" "example2" {
  name                   = "example2-flexibleserver"
  resource_group_name    = azurerm_resource_group.example2.name
  location               = azurerm_resource_group.example2.location
  version                = "13"
  administrator_login    = "psqladmin"
  administrator_password = "H@Sh1CoR3!"
  storage_mb             = 32768
  sku_name               = "B_Standard_B1ms"
}

resource "azurerm_postgresql_flexible_server_configuration" "positive4" {
  name      = "connection_throttle.enable"
  server_id = azurerm_postgresql_flexible_server.example2.id
  value     = "off"
}