PostgreSQL servers should use the latest TLS version
This control checks whether the PostgreSQL server is upgraded to the latest TLS version. It aligns with Checkov `CKV_AZURE_147`, which asks to ensure PostgreSQL is using the latest version of TLS encryption for its connections.
What this control checks
PostgreSQL server must use the latest TLS version (ssl_minimal_tls_version_enforced set
Common pitfalls
Missing ssl_minimal_tls_version_enforced fails
The check inspects ssl_minimal_tls_version_enforced on azurerm_postgresql_server. The check expects TLS1_2, and a missing value is a failure.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.postgres_db_server_latest_tls_version.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_147; KICS query "Beta - PostgreSQL Not Using Latest TLS Encryption Version" (9f15ecc4-d9df-44ba-bb88-28c97e946114).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
postgres_db_server_latest_tls_version - Checkov Check:
CKV_AZURE_147 - Powerpipe Control:
azure_compliance.control.postgres_db_server_latest_tls_version - KICS Query:
9f15ecc4-d9df-44ba-bb88-28c97e946114
Last reviewed: 2026-10-14