require_secure_transport should be set to "on" for Azure Database for PostgreSQL servers

What does the recommendation "require_secure_transport should be set to "on" for Azure Database for PostgreSQL servers" check?

Flags any Azure Database for PostgreSQL flexible server whose 'require_secure_transport' server parameter is set to 'off', which lets clients connect over plaintext as well as TLS. It reads only that one server parameter at the server level. It does not check the minimum negotiated TLS version, which is governed separately by 'ssl_min_protocol_version' (the flexible server enforces TLS 1.2 as the floor by default), nor whether your clients actually present 'sslmode=require', nor the certificate chain they trust. A server can therefore pass this check while still leaving cipher and protocol hardening to those other settings, so treat it as the floor, not the ceiling, of your in-transit posture. The check also does not apply to the retired single-server deployment model, which used a separate 'SSL enforcement' toggle rather than this parameter, so do not confuse the two recommendations when you triage findings across a mixed estate.

Why does "require_secure_transport should be set to "on" for Azure Database for PostgreSQL servers" matter?

When secure transport is off, the server still accepts unencrypted sessions, so any connection that does not explicitly opt in to TLS travels as cleartext. An attacker positioned on the path, a compromised peered network, a misrouted private endpoint or a mirrored subnet, can read query text, credentials and returned rows straight off the wire. Because the database happily serves both encrypted and plaintext clients, the gap is invisible in normal operation and tends to surface only in a breach report or a penetration test. For a database holding customer records or payment data, that plaintext exposure is the kind of finding that turns a contained incident into a reportable breach, with the regulatory notification and contractual fallout that follows. Setting the parameter to 'on' forces the server to refuse any unencrypted session and return a connection error instead, closing the downgrade path for every client at once and giving you a single enforced control to point auditors at.

How do I fix "require_secure_transport should be set to "on" for Azure Database for PostgreSQL servers"?

1. Set the server parameter with 'az postgres flexible-server parameter set --resource-group <rg> --server-name <server> --name require_secure_transport --value on'. This applies without a restart; confirm clients use 'sslmode=require' or stronger before rolling out.
2. In Bicep or Terraform, manage the value as a configuration resource (the 'Microsoft.DBforPostgreSQL/flexibleServers/configurations' resource named 'require_secure_transport' with value 'on') so the setting is declared in source rather than clicked in the portal.
3. Audit the estate at scale by assigning the built-in policy by its exact display name rather than a hardcoded GUID: pid=$(az policy definition list --query "[?displayName=='Enforce SSL connection should be enabled for PostgreSQL flexible servers'].name" -o tsv); az policy assignment create --name pg-require-secure-transport --policy "$pid" --scope <scope>.

# 1. Lock the wire and the network on a production PostgreSQL flexible server.
RG=db-prod-rg
SRV=ordersprod-pg

# Enforce encrypted connections (dynamic, no restart needed).
az postgres flexible-server parameter set \
  --resource-group "$RG" --server-name "$SRV" \
  --source user-override \
  --name require_secure_transport --value ON

# Pin the minimum TLS version.
az postgres flexible-server parameter set \
  --resource-group "$RG" --server-name "$SRV" \
  --source user-override \
  --name ssl_min_protocol_version --value TLSv1.2

# Disable public network access.
az postgres flexible-server update \
  --resource-group "$RG" --name "$SRV" \
  --public-access Disabled

# 2. Turn on the pgaudit trail and connection throttling.
for p in "pgaudit.log=role,ddl,misc" \
         "pgaudit.log_client=ON" \
         "pgaudit.log_level=log" \
         "pgaudit.log_statement=on" \
         "pgaudit.log_statement_once=on" \
         "connection_throttle.enable=on"; do
  az postgres flexible-server parameter set \
    --resource-group "$RG" --server-name "$SRV" \
    --source user-override \
    --name "${p%%=*}" --value "${p#*=}"
done

# 3. Provision a Microsoft Entra administrator and disable password sign-in.
az postgres flexible-server ad-admin create \
  --resource-group "$RG" --server-name "$SRV" \
  --display-name "dba-team" \
  --object-id "$(az ad group show --group dba-team --query id -o tsv)" \
  --type Group
az postgres flexible-server update \
  --resource-group "$RG" --name "$SRV" \
  --microsoft-entra-auth Enabled --password-auth Disabled

# 4. Ratchet it shut: deny any future PostgreSQL flexible server with public access.
# Look the built-in policy up by its EXACT display name, never paste a guessed GUID.
PID=$(az policy definition list \
  --query "[?displayName=='Public network access should be disabled for PostgreSQL flexible servers'].name" \
  -o tsv)
az policy assignment create \
  --name deny-public-pg-flex \
  --policy "$PID" \
  --params '{"effect":{"value":"Deny"}}' \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"