PostgreSQL servers should have 'Enforce SSL connection' enabled
Azure Database for PostgreSQL supports connecting your server to client applications using SSL. Enforcing SSL connections helps protect against 'man in the middle' attacks by encrypting the data stream. This configuration enforces that SSL is always enabled.
Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. SSL connections should be enforced were available to ensure secure transfer and reduce the risk of compromising data in flight.
What this control checks
Whether Enforce SSL connection is enabled on each PostgreSQL server
Common pitfalls
Unset ssl_enforcement_enabled fails the check
KICS flags an azurerm_postgresql_server with ssl_enforcement_enabled set to false or not set.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Enforce SSL connection should be enabled for PostgreSQL database servers" (d158790f-bfb0-486c-8631-2dc6b4e8e6af); PowerPipe control azure_compliance.control.postgres_sql_ssl_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_29; KICS query "SSL Enforce Disabled" (0437633b-daa6-4bbc-8526-c0d2443b946e); Trivy check AZU-0020.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-8 (Transmission Confidentiality and Integrity) and SC-8(1) (Cryptographic Protection).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-8 (Transmission Confidentiality And Integrity) and SC-8(1) (Cryptographic Or Alternate Physical Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
FedRAMP Moderate Baseline Rev 4
- SC-8 (1): Cryptographic Or Alternate Physical Protection
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- 3.1.h Public Key Infrastructure (PKI)
- 4.3.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server
- 4.3.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server
- 4.3.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server
- 4.3.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server
- 4.3.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server
- SC.L2-3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards
- SC-8 Transmission Confidentiality And Integrity
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 0809.01n2Organizational.1234-01.n 01.04 Network Access Control
- 0810.01n2Organizational.5-01.n 01.04 Network Access Control
- 0811.01n2Organizational.6-01.n 01.04 Network Access Control
- 0812.01n2Organizational.8-01.n 01.04 Network Access Control
- 0814.01n1Organizational.12-01.n 01.04 Network Access Control
2 more clauses
- 0947.09y2Organizational.2-09.y 09.09 Electronic Commerce Services
- 1450.05i2Organizational.2-05.i 05.02 External Parties
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
postgres_sql_ssl_enabled - Checkov Check:
CKV_AZURE_29 - Powerpipe Control:
azure_compliance.control.postgres_sql_ssl_enabled - Azure Policy Definition:
d158790f-bfb0-486c-8631-2dc6b4e8e6af - KICS Query:
0437633b-daa6-4bbc-8526-c0d2443b946e - Trivy Check:
AZU-0020
Last reviewed: 2026-10-14