PostgreSQL server without connection throttling

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: terraform-azure-postgresql-server-without-connection-throttling

Provider: Azure

Platform: Terraform

Severity: Medium

Category: Observability

Learn More

Description

PostgreSQL servers should have connection throttling enabled by setting the connection_throttling configuration value to "on". Without connection throttling (for example, value = "off"), the server is more vulnerable to connection floods and denial-of-service attacks, as there is no mechanism to limit the rate of incoming connections. Enabling this option reduces the risk of service disruption by preventing excessive connection attempts from overloading the database.

A secure Terraform configuration example is shown below:

resource "azurerm_postgresql_configuration" "example" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "on"
}

Compliant Code Examples

resource "azurerm_postgresql_configuration" "negative1" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "on"
}

resource "azurerm_postgresql_configuration" "negative2" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "On"
}

resource "azurerm_postgresql_configuration" "negative3" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "ON"
}

resource "azurerm_resource_group" "example2" {
  name     = "example2-rg"
  location = "eastus"
}

resource "azurerm_postgresql_flexible_server" "example2" {
  name                   = "example2-flexibleserver"
  resource_group_name    = azurerm_resource_group.example2.name
  location               = azurerm_resource_group.example2.location
  version                = "13"
  administrator_login    = "psqladmin"
  administrator_password = "H@Sh1CoR3!"
  storage_mb             = 32768
  sku_name               = "B_Standard_B1ms"
}

resource "azurerm_postgresql_flexible_server_configuration" "negative4" {
  name      = "connection_throttle.enable"
  server_id = azurerm_postgresql_flexible_server.example2.id
  value     = "on"
}

Non-Compliant Code Examples

resource "azurerm_postgresql_configuration" "positive1" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "off"
}

resource "azurerm_postgresql_configuration" "positive2" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "Off"
}

resource "azurerm_postgresql_configuration" "positive3" {
    name                = "connection_throttling"
    resource_group_name = data.azurerm_resource_group.example.name
    server_name         = azurerm_postgresql_server.example.name
    value               = "OFF"
}

resource "azurerm_resource_group" "example2" {
  name     = "example2-rg"
  location = "eastus"
}

resource "azurerm_postgresql_flexible_server" "example2" {
  name                   = "example2-flexibleserver"
  resource_group_name    = azurerm_resource_group.example2.name
  location               = azurerm_resource_group.example2.location
  version                = "13"
  administrator_login    = "psqladmin"
  administrator_password = "H@Sh1CoR3!"
  storage_mb             = 32768
  sku_name               = "B_Standard_B1ms"
}

resource "azurerm_postgresql_flexible_server_configuration" "positive4" {
  name      = "connection_throttle.enable"
  server_id = azurerm_postgresql_flexible_server.example2.id
  value     = "off"
}