[LEGACY] Ensure 'Infrastructure double encryption' for PostgreSQL single server is 'Enabled'

Overview

Azure Database for PostgreSQL servers should be created with 'infrastructure double encryption' enabled.

NOTE: This recommendation currently only applies to Single Server, not Flexible Server. See the additional information below for details about the planned retirement of Azure PostgreSQL Single Server.

Rationale

If Double Encryption is enabled, another layer of encryption is implemented at the hardware level before the storage or network level. Information will be encrypted before it is even accessed, preventing interception of data in motion if the network layer encryption is broken and data is at rest in system resources such as memory or processor cache. Encryption will also be in place for any backups taken of the database so that the key will secure access to the data in all forms. For the most secure implementation of key-based encryption, it is recommended to use a Customer-managed asymmetric RSA 2048 Key in Azure Key Vault.

Impact

The read and write speeds to the database will be impacted if both default encryption and Infrastructure Encryption are checked, as a secondary form of encryption requires more resource overhead for the cryptography of information. This cost is justified for information security.

Customer-managed keys are recommended for the most secure implementation, leading to the overhead of key management. The key will also need to be backed up in a secure location, as losing the key will mean losing the information in the database.

Default Value

By default, Double Encryption is disabled.

Additional Information

RETIREMENT of Azure PostgreSQL Single Server: Azure PostgreSQL Single Server is slated for retirement by March 25, 2025. Please use these resources to consider and prepare for migration:

Remediation guidance

It is not possible to enable 'infrastructure double encryption' on an existing Azure Database for PostgreSQL server.

The remediation steps detail creating a new Azure Database for PostgreSQL server with 'infrastructure double encryption' enabled.

Remediate from Azure Portal

Go through the normal process of database creation.
On step 2 titled Additional settings ensure that Infrastructure double encryption enabled is checked.
Acknowledge that you understand this will impact database performance.
Finish database creation as normal.

Remediate from Azure CLI

az postgres server create --resource-group <resourcegroup> --name <servername>  --location <location> --admin-user <adminusername> --admin-password <server_admin_password> --sku-name GP_Gen4_2 --version 11 --infrastructure-encryption Enabled

Multiple Remediation Paths

Azure

SERVICE-WIDE (RECOMMENDED when many resources are affected): Assign Azure Policy initiatives at management group/subscription scope and trigger remediation tasks.

az policy assignment create --name <assignment-name> --scope /subscriptions/<subscription-id> --policy-set-definition <initiative-id>
az policy remediation create --name <remediation-name> --policy-assignment <assignment-id>

ASSET-LEVEL: Apply the resource-specific remediation steps above to the listed non-compliant resources.

PREVENTIVE: Embed Azure Policy checks into landing zones and IaC workflows to block or auto-remediate drift.

References for Service-Wide Patterns

Azure Policy overview: https://learn.microsoft.com/en-us/azure/governance/policy/overview
Azure Policy remediation: https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources
Azure Policy initiative structure: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/initiative-definition-structure

Operational Rollout Workflow

Use this sequence to reduce risk and avoid repeated drift.

1. Contain at Service-Wide Scope First (Recommended)

Azure: assign policy initiatives at management group/subscription scope and run remediation tasks.

az policy assignment create --name <assignment-name> --scope /subscriptions/<subscription-id> --policy-set-definition <initiative-id>
az policy remediation create --name <remediation-name> --policy-assignment <assignment-id>

2. Remediate Existing Affected Assets

Execute the control-specific Console/CLI steps documented above for each flagged resource.
Prioritize internet-exposed and production assets first.

3. Validate and Prevent Recurrence

Re-scan after each remediation batch.
Track exceptions with owner and expiry date.
Add preventive checks in IaC/CI pipelines.

Query logic

These are the stored checks tied to this control.

Azure Postgres Single Servers without infrastructure encryption

Connectors

Microsoft Azure

Covered asset types

PostgreSQLServer

Expected check: eq []

{
  postgreSqlServers(where: { infrastructureEncryption: "Disabled" }) {
    ...AssetFragment
  }
}