PostgreSQL server without connection throttling

This product is not supported for your selected Datadog site. ().
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Metadata

Id: terraform-azure-postgresql-server-without-connection-throttling

Provider: Azure

Platform: Terraform

Severity: Medium

Category: Observability

Learn More

Description

PostgreSQL servers should have connection throttling enabled by setting the connection_throttling configuration value to "on". Without connection throttling (for example, value = "off"), the server is more vulnerable to connection floods and denial-of-service attacks, as there is no mechanism to limit the rate of incoming connections. Enabling this option reduces the risk of service disruption by preventing excessive connection attempts from overloading the database.

A secure Terraform configuration example is shown below:

resource "azurerm_postgresql_configuration" "example" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "on"
}

Compliant Code Examples

resource "azurerm_postgresql_configuration" "negative1" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "on"
}

resource "azurerm_postgresql_configuration" "negative2" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "On"
}

resource "azurerm_postgresql_configuration" "negative3" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "ON"
}

resource "azurerm_resource_group" "example2" {
  name     = "example2-rg"
  location = "eastus"
}

resource "azurerm_postgresql_flexible_server" "example2" {
  name                   = "example2-flexibleserver"
  resource_group_name    = azurerm_resource_group.example2.name
  location               = azurerm_resource_group.example2.location
  version                = "13"
  administrator_login    = "psqladmin"
  administrator_password = "H@Sh1CoR3!"
  storage_mb             = 32768
  sku_name               = "B_Standard_B1ms"
}

resource "azurerm_postgresql_flexible_server_configuration" "negative4" {
  name      = "connection_throttle.enable"
  server_id = azurerm_postgresql_flexible_server.example2.id
  value     = "on"
}

Non-Compliant Code Examples

resource "azurerm_postgresql_configuration" "positive1" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "off"
}

resource "azurerm_postgresql_configuration" "positive2" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "Off"
}

resource "azurerm_postgresql_configuration" "positive3" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "OFF"
}

resource "azurerm_resource_group" "example2" {
  name     = "example2-rg"
  location = "eastus"
}

resource "azurerm_postgresql_flexible_server" "example2" {
  name                   = "example2-flexibleserver"
  resource_group_name    = azurerm_resource_group.example2.name
  location               = azurerm_resource_group.example2.location
  version                = "13"
  administrator_login    = "psqladmin"
  administrator_password = "H@Sh1CoR3!"
  storage_mb             = 32768
  sku_name               = "B_Standard_B1ms"
}

resource "azurerm_postgresql_flexible_server_configuration" "positive4" {
  name      = "connection_throttle.enable"
  server_id = azurerm_postgresql_flexible_server.example2.id
  value     = "off"
}