connection_throttle should be set to "on" for PostgreSQL Servers

What does the recommendation "connection_throttle should be set to "on" for PostgreSQL Servers" check?

Flags any Azure Database for PostgreSQL flexible server whose 'connection_throttle.enable' server parameter is 'off', which is the default value. When set to 'on', the engine temporarily refuses new connections from a source IP after repeated invalid password attempts, slowing brute-force and credential-stuffing runs against that address. The check reads only this one parameter on the flexible server tier, not the older single server. It does not look at firewall rules, private endpoints, the max_connections ceiling, SSL enforcement, or whether public network access is open, so a server can pass this control and still be directly reachable from the internet. Treat it as one layer of defence rather than the whole story.

Why does "connection_throttle should be set to "on" for PostgreSQL Servers" matter?

A PostgreSQL endpoint exposed to the network is a standing target for password guessing. With throttling off, an attacker can hammer a single account from one IP at full speed, and because each failed login is cheap, a weak or leaked password is found in hours rather than weeks. Turning 'connection_throttle.enable' on forces a per-IP back-off after too many invalid attempts, which raises the cost of an online attack and gives your monitoring a wider window to recognise the pattern and respond. The behaviour also dampens accidental connection storms from a misconfigured client looping on bad credentials. The business consequence of skipping it is the usual one for a breached database: exfiltration of customer records, regulatory exposure under regimes that licence the handling of personal data, and forced credential rotation across every service that depends on the instance.

How do I fix "connection_throttle should be set to "on" for PostgreSQL Servers"?

1. Set the parameter directly on the instance: az postgres flexible-server parameter set --resource-group <rg> --server-name <server> --name connection_throttle.enable --value on. No restart is required, the change applies to new connections.
2. Bake it into the deployment so new servers ship safe by default. In Bicep, declare a Microsoft.DBforPostgreSQL/flexibleServers/configurations resource named 'connection_throttle.enable' with properties { source: 'user-override', value: 'on' } parented to the server.
3. Enforce it across the estate with the built-in audit policy. Look the definition up by display name rather than pasting a GUID: pid=$(az policy definition list --query "[?displayName=='Connection throttling should be enabled for PostgreSQL flexible servers'].name" -o tsv) then az policy assignment create --name pg-conn-throttle --policy "$pid" --scope <scope>.

# 1. Lock the wire and the network on a production PostgreSQL flexible server.
RG=db-prod-rg
SRV=ordersprod-pg

# Enforce encrypted connections (dynamic, no restart needed).
az postgres flexible-server parameter set \
  --resource-group "$RG" --server-name "$SRV" \
  --source user-override \
  --name require_secure_transport --value ON

# Pin the minimum TLS version.
az postgres flexible-server parameter set \
  --resource-group "$RG" --server-name "$SRV" \
  --source user-override \
  --name ssl_min_protocol_version --value TLSv1.2

# Disable public network access.
az postgres flexible-server update \
  --resource-group "$RG" --name "$SRV" \
  --public-access Disabled

# 2. Turn on the pgaudit trail and connection throttling.
for p in "pgaudit.log=role,ddl,misc" \
         "pgaudit.log_client=ON" \
         "pgaudit.log_level=log" \
         "pgaudit.log_statement=on" \
         "pgaudit.log_statement_once=on" \
         "connection_throttle.enable=on"; do
  az postgres flexible-server parameter set \
    --resource-group "$RG" --server-name "$SRV" \
    --source user-override \
    --name "${p%%=*}" --value "${p#*=}"
done

# 3. Provision a Microsoft Entra administrator and disable password sign-in.
az postgres flexible-server ad-admin create \
  --resource-group "$RG" --server-name "$SRV" \
  --display-name "dba-team" \
  --object-id "$(az ad group show --group dba-team --query id -o tsv)" \
  --type Group
az postgres flexible-server update \
  --resource-group "$RG" --name "$SRV" \
  --microsoft-entra-auth Enabled --password-auth Disabled

# 4. Ratchet it shut: deny any future PostgreSQL flexible server with public access.
# Look the built-in policy up by its EXACT display name, never paste a guessed GUID.
PID=$(az policy definition list \
  --query "[?displayName=='Public network access should be disabled for PostgreSQL flexible servers'].name" \
  -o tsv)
az policy assignment create \
  --name deny-public-pg-flex \
  --policy "$PID" \
  --params '{"effect":{"value":"Deny"}}' \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"