Azure Backup for PostgreSQL Flexible Server - Protection Error: PostgreSQLFlexOperationFailedUserError

Question

Problem Description

I have configured Azure Backup for a PostgreSQL Flexible Server using Terraform. The PostgreSQL Flexible Server instance is healthy and running without issues, but the backup instance shows a "Protection Error" status with the following error:

Error Code: PostgreSQLFlexOperationFailedUserError Message: "Current operation has failed due to a user error." Protection Status: Protection Error

Infrastructure Configuration

Backup Vault:

• System-assigned Managed Identity enabled
• Soft delete: On (14 days retention)
• Datastore type: VaultStore

RBAC Role Assignments:

1. Reader role assigned to Backup Vault's Managed Identity on the Resource Group scope
2. Backup Operator role assigned to Backup Vault's Managed Identity on the PostgreSQL Flexible Server scope

Backup Policy:

• Daily backups at 02:00 UTC
• Retention rules:
  • Daily: 14 days (FirstOfDay)
    • Weekly: 30 days (FirstOfWeek)
      • Monthly: 365 days (FirstOfMonth)
        • Default: 365 days

Backup Instance:

• Linked to the backup vault and policy
• Server ID correctly references the PostgreSQL Flexible Server

  Infrastructure Configuration

  Backup Vault:
  • System-assigned Managed Identity enabled
  • Soft delete: On (14 days retention)
  • Datastore type: VaultStore
  RBAC Role Assignments:
  1. Reader role assigned to Backup Vault's Managed Identity on the Resource Group scope
  2. Backup Operator role assigned to Backup Vault's Managed Identity on the PostgreSQL Flexible Server scope
  Backup Policy:
  • Daily backups at 02:00 UTC
  • Retention rules:
    • Daily: 14 days (FirstOfDay)
    • Weekly: 30 days (FirstOfWeek)
    • Monthly: 365 days (FirstOfMonth)
    • Default: 365 days
  Backup Instance:
  • Linked to the backup vault and policy
  • Server ID correctly references the PostgreSQL Flexible Server

What I've Verified

• ✅ PostgreSQL Flexible Server is healthy and operational
• ✅ Backup Vault Managed Identity is created successfully
• ✅ Role assignments (Reader, Backup Operator) are in place
• ✅ Terraform apply completes without errors
• ✅ Dependencies are correctly set (role assignments created before backup policy/instance)

Questions

1. The error message PostgreSQLFlexOperationFailedUserError is vague. What specific permissions or configurations could be missing?
2. Is the Backup Operator role sufficient, or does the Managed Identity require additional roles such as PostgreSQL Flexible Server Long Term Retention Backup Role?
3. Are there any known issues with VaultStore backups for PostgreSQL Flexible Servers in the any region like eu-central?

Terraform Code Snippet

# Role Assignments

resource "azurerm_role_assignment" "cloudops_db_backup_vault_reader" {

  scope                = data.azurerm_resource_group.postgres_resource_group.id

  role_definition_name = "Reader"

  principal_id         = azurerm_data_protection_backup_vault.cloudops_db_backup_vault.identity.0.principal_id

}

resource "azurerm_role_assignment" "cloudops_db_backup_vault_backup_role" {

  scope                = azurerm_postgresql_flexible_server.postgresql.id

  role_definition_name = "Backup Operator"

  principal_id         = azurerm_data_protection_backup_vault.cloudops_db_backup_vault.identity.0.principal_id

}

# Backup Instance

resource "azurerm_data_protection_backup_instance_postgresql_flexible_server" "cloudops_general_db_backup_plan" {

  name             = "cloudops-general-db-backup-plan"

  location         = azurerm_postgresql_flexible_server.postgresql.location

  vault_id         = azurerm_data_protection_backup_vault.cloudops_db_backup_vault.id

  server_id        = azurerm_postgresql_flexible_server.postgresql.id

  backup_policy_id = azurerm_data_protection_backup_policy_postgresql_flexible_server.cloudops_db_backup_policy.id

}

Answer 1

Hi Kiarash Azarnia,
Thank you for Reaching microsoft Q&A!.
We’ve reviewed your configuration and the PostgreSQL Flexible Server itself is healthy. The Protection Error you’re seeing is not caused by Terraform or the backup policy, but by a missing service prerequisite.

For Azure Backup (VaultStore) with PostgreSQL Flexible Server, RBAC permissions alone are not sufficient. During protection enablement and backup validation, the Azure Backup service must be able to reach the PostgreSQL server over the network.

In your current setup, the issue is caused by one or both of the following:

Public network access is disabled on the PostgreSQL Flexible Server, or “Allow Azure services to access this server” is not enabled in the firewall settings.

When the backup service cannot connect to the server, the platform returns the generic error PostgreSQLFlexOperationFailedUserError, even though the server itself is healthy.

To resolve the issue, please ensure the following:

Enable Public network access on the PostgreSQL Flexible Server. Under Firewall rules, enable Allow public access from Azure services.

Additionally, please note that the Backup Operator role is not the correct role for PostgreSQL Flexible Server backups. The Backup Vault’s managed identity must be assigned the PostgreSQL Flexible Server Backup Operator role at the server scope. No Long-Term Retention role is required for Flexible Server backups.

There are no known regional issues with VaultStore backups for PostgreSQL Flexible Server in eu-central or other regions.

After updating the firewall settings and correcting the role assignment, allow a few minutes for propagation and then retry the protection operation. The backup instance should automatically transition from Protection Error to Protected.

If you want, I can also help validate the exact role definition name in Terraform to avoid RBAC mismatches.

Answer 2

The error code PostgreSQLFlexOperationFailedUserError signifies a user error during the backup operation for your PostgreSQL Flexible Server. Here are some specific areas to investigate and potential solutions:

1. Permissions: While you have assigned the Backup Operator role, it may be beneficial to also assign the PostgreSQL Flexible Server Long Term Retention Backup Role. This role provides additional permissions that might be necessary for successful backup operations.
2. Server State: Confirm that your PostgreSQL Flexible Server is in a valid state for backups. The server's state should be reflected as "state": "Ready" in its resource JSON. If it is not in this state, you will need to wait for it to become ready or address any underlying issues.
3. Resource Validity: Ensure that both the resource group and the PostgreSQL Flexible Server instance are correctly referenced and exist. Errors such as ResourceGroupNotFound or ResourceNotFound can indicate issues with these references.
4. Backup Frequency: Be cautious about the frequency of your backup operations. If you are attempting to run backups too frequently, you may encounter the maximum concurrent operation limit. The recommended backup frequency is weekly, so ensure you are not exceeding this limit.
5. Regional Issues: Lastly, check for any known issues with VaultStore backups for PostgreSQL Flexible Servers in the eu-central region. It may be helpful to consult Azure's documentation or support for any specific issues that could be affecting your backup operations.

By addressing these areas, you should be able to troubleshoot and resolve the protection error you are experiencing.