Azure Compliance ControlsAzure Database for PostgreSQL
PostgreSQL flexible servers should have log_connections enabled
Azure Database for PostgreSQL Flexible Server evaluates the `log_connections` setting that controls logging of client connection attempts and authentication results. The finding indicates whether this parameter is set to `ON`.
What this control checks
The log_connections server parameter must be set to ON on PostgreSQL flexible servers.
Framework mappings
The clauses this control is mapped to in each framework.
- CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
- A.8.15 Logging
- 2 Risk management policy
- 3 Incident handling
- 11 Access control
- AM-01.01AC The information collected about assets is considered in logging and monitoring applications to identify the impact on cloud services and functions in case of events that could lead to a breach of protection objectives, and to support information provided to affected cloud service...
- COS-03.02B Physical and virtualised network environments are designed and configured to restrict and monitor the established connection to trusted or untrusted networks according to the defined security requirements.
- DEV-08.02B The configuration of these system components ensures that all changes to system components in the production environment are recorded and can be traced back to the individuals or system components contributing to their development, deployment or implementation.
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments.
8 more clauses
- OPS-15.01AC On request of the cloud service customer, the cloud service provider provides the logs relating to the cloud service customer in an appropriate form and in a timely manner so that the cloud service customer can investigate any incidents relating to them.
- OPS-15.01B The log data generated (cloud service derived data and cloud service provider data) allows an unambiguous identification of user accesses at tenant level to support (forensic) analysis in the event of an incident.
- OPS-15.02B Each logged event shall include a time/date stamp to ensure accurate and traceable records.
- OPS-15.03B The cloud service provider is able to support forensic analysis of incidents and to retain a chain of evidence. This implies that the cloud service provider capture the state of infrastructure components and network communication during security events.
- OPS-26.05B The cloud service provider implements monitoring measures to ensure system components comply with hardening specifications.
- PSS-04.01B The cloud service provided is equipped with error handling and logging mechanisms for system components under the responsibility of the cloud service customer. These enable cloud users to obtain security-related information about the security status of the cloud service as well as the...
- SIM-03.06B All documents and evidence that provide details on security incidents related to the cloud service are archived in a way that could be used as evidence in court. Security mechanisms and processes for protecting all the information about security incidents related to the cloud service...
- SIM-03.07B The analysis process also ensures traceability of the entire kill chain of a security incident.
- 4.3.3 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server
- 4.3.3 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server
- 5.2.6 [LEGACY]Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL single Server
- 164.312(b) Audit controls
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_postgresql_flexible_server_log_connections_on - Prowler Check:
postgresql_flexible_server_log_connections_on - Azure Policy Definition:
086709ac-11b5-478d-a893-9567a16d2ae3
Last reviewed: 2026-10-11