Can you change a postgresql flexserver parameter using an Azure policy / remediation ?

Question

Would like to be able to use an Azure policy to audit and change the connection throttling from off to on (for security) for a large number of PostgreSQL flex servers.

Answer 1

@Burket, Joseph

Use the below sample:

{

"mode": "All",

"policyRule": {

"if": {

  "allOf": [

    {

      "field": "type",

      "equals": "Microsoft.DBforPostgreSQL/flexibleServers"

    }

  ]

},

"then": {

  "effect": "[parameters('effect')]",

  "details": {

    "type": "Microsoft.DBforPostgreSQL/flexibleServers/configurations",

    "name": "require_secure_transport",

    "existenceCondition": {

      "field": "Microsoft.DBforPostgreSQL/flexibleServers/configurations/value",

      "equals": "ON"

    },

    "roleDefinitionIds": [

      "/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"

    ],

    "deployment": {

      "properties": {

        "mode": "incremental",

        "template": {

          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",

          "contentVersion": "1.0.0.0",

          "parameters": {

            "serverName": {

              "type": "string"

            }

          },

          "variables": {},

          "resources": [

            {

              "name": "[concat(parameters('serverName'), '/connection_throttle.enable)]",

              "type": "Microsoft.DBforPostgreSQL/flexibleServers/configurations",

              "apiVersion": "2022-01-20-preview",

              "properties": {

                "value": "ON",

                "source": "user-override"

              }

            }

          ]

        },

        "parameters": {

          "serverName": {

            "value": "[field('name')]"

          }

        }

      }

    }

  }

}

},

"parameters": {

"effect": {

  "type": "String",

  "metadata": {

    "displayName": "Effect",

    "description": "Enable or disable the execution of the policy"

  },

  "allowedValues": [

    "DeployIfNotExists",

    "Disabled"

  ],

  "defaultValue": "DeployIfNotExists"

}

}

}

Regards,

Oury