Azure Compliance ControlsAzure Database for PostgreSQL
PostgreSQL servers should have infrastructure encryption enabled
Checks whether each Azure Database for PostgreSQL server has the `infrastructure encryption` setting turned on. The evaluation inspects this setting on every PostgreSQL server in scope and looks only at whether `infrastructure encryption` is enabled or not.
What this control checks
Data at rest is encrypted twice
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- 3.1.h Public Key Infrastructure (PKI)
- 4.3.8 Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled'
- 4.3.8 Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled'
- 4.3.8 Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled'
- 4.3.8 Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled'
- 5.2.8 [LEGACY]Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled'
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
postgresql_server_infrastructure_encryption_enabled - Checkov Check:
CKV_AZURE_130 - Powerpipe Control:
azure_compliance.control.postgresql_server_infrastructure_encryption_enabled - Azure Policy Definition:
24fba194-95d6-48c0-aea7-f65bf859c598 - KICS Query:
6425c98b-ca4e-41fe-896a-c78772c131f8
Last reviewed: 2026-10-14