Project: KICS (Provisioning / Security & Compliance)
File: bf500309-da53-4dd3-bcf7-95f7974545a5.md

title: PostgreSQL Database Server SSL Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: bf500309-da53-4dd3-bcf7-95f7974545a5 Query name: PostgreSQL Database Server SSL Disabled Platform: AzureResourceManager Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Microsoft.DBforPostgreSQL/servers sslEnforcement property should be set to 'Enabled'<br> ```json title="Positive test num. 1 - json file" hl_lines="14" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "functions": [], "variables": {}, "resources": [ { "apiVersion": "2017-12-01", "kind": "", "location": "[resourceGroup().location]", "name": "MyDBServer", "properties": { "sslEnforcement": "Disabled", "version": "11", "administratorLogin": "root", "administratorLoginPassword": "12345", "storageMB": "2048", "createMode": "Default", "collation": "SQLLatin1GeneralCP1CI_AS", "creationDate": "2019-04-01T00:00:00Z", "lastModifiedDate": "2019-04-01T00:00:00Z", "maxSizeUnits": "SizeUnit.megabytes", "isReadOnly": "false", "isAutoUpgradeEnabled": "true", "isStateful": "false", "isExternal": "false" }, "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseDTU')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "SkuFamily" }, "type": "Microsoft.DBforPostgreSQL/servers", "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[resourceGroup().location]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "myDB1", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', 'MyDBServer')]" ] } ] } ], "outputs": {} } ``` ```json title="Positive test num. 2 - json file" hl_lines="13" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "functions": [], "variables": {}, "resources": [ { "apiVersion": "2017-12-01", "kind": "", "location": "[resourceGroup().location]", "name": "MyDBServer", "properties": { "version": "11", "administratorLogin": "root", "administratorLoginPassword": "12345", "storageMB": "2048", "createMode": "Default", "collation": "SQLLatin1GeneralCP1CI_AS", "creationDate": "2019-04-01T00:00:00Z", "lastModifiedDate": "2019-04-01T00:00:00Z", "maxSizeUnits": "SizeUnit.megabytes", "isReadOnly": "false", "isAutoUpgradeEnabled": "true", "isStateful": "false", "isExternal": "false", "defaultSecondaryLocation": "[resourceGroup().location]", "maxSizeInGB": "10", "isEncrypted": "false", "isNetworkAccessible": "true", "identity": "" }, "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseDTU')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "SkuFamily" }, "type": "Microsoft.DBforPostgreSQL/servers", "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[resourceGroup().location]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "myDB1", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', 'MyDBServer')]" ] } ] } ], "outputs": {} } ``` ```json title="Positive test num. 3 - json file" hl_lines="16" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "functions": [], "variables": {}, "resources": [ { "apiVersion": "2017-12-01", "kind": "", "location": "[resourceGroup().location]", "name": "MyDBServer", "properties": { "sslEnforcement": "Disabled", "version": "11", "administratorLogin": "root", "administratorLoginPassword": "12345", "storageMB": "2048", "createMode": "Default", "collation": "SQLLatin1GeneralCP1CI_AS", "creationDate": "2019-04-01T00:00:00Z", "lastModifiedDate": "2019-04-01T00:00:00Z", "maxSizeUnits": "SizeUnit.megabytes", "isReadOnly": "false", "isAutoUpgradeEnabled": "true", "isStateful": "false", "isExternal": "false" }, "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseDTU')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "SkuFamily" }, "type": "Microsoft.DBforPostgreSQL/servers", "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[resourceGroup().location]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "myDB1", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [

'MyDBServer')]" ] } ] } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="15" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "functions": [], "variables": {}, "resources": [ { "apiVersion": "2017-12-01", "kind": "", "location": "[resourceGroup().location]", "name": "MyDBServer", "properties": { "version": "11", "administratorLogin": "root", "administratorLoginPassword": "12345", "storageMB": "2048", "createMode": "Default", "collation": "SQLLatin1GeneralCP1CI_AS", "creationDate": "2019-04-01T00:00:00Z", "lastModifiedDate": "2019-04-01T00:00:00Z", "maxSizeUnits": "SizeUnit.megabytes", "isReadOnly": "false", "isAutoUpgradeEnabled": "true", "isStateful": "false", "isExternal": "false", "defaultSecondaryLocation": "[resourceGroup().location]", "maxSizeInGB": "10", "isEncrypted": "false", "isNetworkAccessible": "true", "identity": "" }, "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseDTU')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "SkuFamily" }, "type": "Microsoft.DBforPostgreSQL/servers", "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[resourceGroup().location]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "myDB1", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', 'MyDBServer')]" ] } ] } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details> ```json title="Negative test num. 1 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "functions": [], "variables": {}, "resources": [ { "apiVersion": "2017-12-01", "kind": "", "location": "[resourceGroup().location]", "name": "MyDBServer", "properties": { "version": "11", "administratorLogin": "root", "administratorLoginPassword": "12345", "storageMB": "2048", "sslEnforcement": "Enabled", "createMode": "Default", "collation": "SQLLatin1GeneralCP1CI_AS", "creationDate": "2019-04-01T00:00:00Z", "lastModifiedDate": "2019-04-01T00:00:00Z", "maxSizeUnits": "SizeUnit.megabytes", "isReadOnly": "false", "isAutoUpgradeEnabled": "true", "isStateful": "false", "isExternal": "false", "defaultSecondaryLocation": "[resourceGroup().location]", "maxSizeInGB": "10", "isEncrypted": "false", "isNetworkAccessible": "true", "identity": "" }, "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseDTU')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "SkuFamily" }, "type": "Microsoft.DBforPostgreSQL/servers", "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[resourceGroup().location]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "myDB1", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', 'MyDBServer')]" ] } ] } ], "outputs": {} } ``` ```json title="Negative test num. 2 - json file" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "functions": [], "variables": {}, "resources": [ { "apiVersion": "2017-12-01", "kind": "", "location": "[resourceGroup().location]", "name": "MyDBServer", "properties": { "version": "11", "administratorLogin": "root", "administratorLoginPassword": "12345", "storageMB": "2048", "sslEnforcement": "Enabled", "createMode": "Default", "collation": "SQLLatin1GeneralCP1CI_AS", "creationDate": "2019-04-01T00:00:00Z", "lastModifiedDate": "2019-04-01T00:00:00Z", "maxSizeUnits": "SizeUnit.megabytes", "isReadOnly": "false", "isAutoUpgradeEnabled": "true", "isStateful": "false", "isExternal": "false", "defaultSecondaryLocation": "[resourceGroup().location]", "maxSizeInGB": "10", "isEncrypted": "false", "isNetworkAccessible": "true", "identity": "" }, "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseDTU')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "SkuFamily" }, "type": "Microsoft.DBforPostgreSQL/servers", "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[resourceGroup().location]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "myDB1", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', 'MyDBServer')]" ] } ] } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ```