PostgreSQL servers should have infrastructure encryption enabled
Checks whether each Azure Database for PostgreSQL server has the `infrastructure encryption` setting turned on. The evaluation inspects this setting on every PostgreSQL server in scope and looks only at whether `infrastructure encryption` is enabled or not.
Enable infrastructure encryption for Azure Database for PostgreSQL servers to have higher level of assurance that the data is secure.
What this control checks
Data at rest is encrypted twice
Common pitfalls
Policy effect defaults to Audit
The effect parameter has a defaultValue of Audit. The allowed values are Audit, Deny and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Infrastructure encryption should be enabled for Azure Database for PostgreSQL servers" (24fba194-95d6-48c0-aea7-f65bf859c598); PowerPipe control azure_compliance.control.postgresql_server_infrastructure_encryption_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_130; KICS query "PostgreSQL Server Infrastructure Encryption Disabled" (6425c98b-ca4e-41fe-896a-c78772c131f8).
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-28 (Protection of Information at Rest) and SC-28(1) (Cryptographic Protection).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-28 (Protection Of Information At Rest) and SC-28(1) (Cryptographic Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- 3.1.h Public Key Infrastructure (PKI)
- 4.3.8 Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled'
- 4.3.8 Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled'
- 4.3.8 Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled'
- 4.3.8 Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled'
- 5.2.8 [LEGACY]Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled'
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
postgresql_server_infrastructure_encryption_enabled - Checkov Check:
CKV_AZURE_130 - Powerpipe Control:
azure_compliance.control.postgresql_server_infrastructure_encryption_enabled - Azure Policy Definition:
24fba194-95d6-48c0-aea7-f65bf859c598 - KICS Query:
6425c98b-ca4e-41fe-896a-c78772c131f8
Last reviewed: 2026-10-14