Azure Flexible Server: AZU-0020 & AZU-0021 don't detect ssl_min_protocol_version and connection_throttle.enable set via azurerm_postgresql_flexible_server_configuration

[gaminginmydna7-create]

IDs

AZU-0020 & AZU-0021

Description

Trivy's Azure PostgreSQL checks AZU-0020 (Enable SSL Enforcement) and
AZU-0021 (Postgres Configuration Connection Throttling) only evaluate the
legacy single-server resources (azurerm_postgresql_server /
azurerm_postgresql_configuration).

They do not recognise the equivalent settings when they are configured for
Azure Database for PostgreSQL – Flexible Server, which uses different
resources and parameter names:

Setting	Flexible Server resource + parameter
Connection throttle	azurerm_postgresql_flexible_server_configuration name connection_throttle.enable = on
Minimum TLS version	azurerm_postgresql_flexible_server_configuration name ssl_min_protocol_version = TLSv1.2

Because of this, these parameters are silently ignored by Trivy even though they
are correctly applied on the server and clearly visible in the Azure Portal
(Server parameters blade). This leads to a false negative / false positive
depending on how the check is written.

Target checks

• AZU-0020 – Enable SSL Enforcement
• AZU-0021 – Postgres Configuration Connection Throttling

Reproduction Steps

The following Terraform correctly configures both settings on a Flexible Server.
They apply successfully and show up as expected in the Azure Portal, but Trivy
does not associate them with AZU-0020 / AZU-0021:


resource "azurerm_postgresql_flexible_server" "example" {
  name                = "example-flexible-pg"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  sku_name            = "GP_Standard_D2s_v3"
  version             = "16"
  # ...
}

resource "azurerm_postgresql_flexible_server_configuration" "ssl_min_protocol_version" {
  name      = "ssl_min_protocol_version"
  server_id = azurerm_postgresql_flexible_server.example.id
  value     = "TLSv1.2"
}

resource "azurerm_postgresql_flexible_server_configuration" "connection_throttle_enable" {
  name      = "connection_throttle.enable"
  server_id = azurerm_postgresql_flexible_server.example.id
  value     = "on"
}

Target

Filesystem

Scanner

Vulnerability

Target OS

No response

Debug Output

Misconfigurations: 2
  [MEDIUM] AZU-0021 | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server
  [MEDIUM] AZU-0026 | Databases should have the minimum TLS set for connections

Version

trivy version 0.72

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[dlanov]

This is a genuine gap in Trivy's Azure PostgreSQL checks — the built-in rules for AZU-0020 and AZU-0021 were written for the legacy Single Server resource model and have not
been updated to cover Flexible Server.

Why it happens

Trivy's misconfig checks are Rego policies that pattern-match on specific Terraform resource types. AZU-0020 and AZU-0021 look for:

• azurerm_postgresql_server — the legacy single-server resource
• azurerm_postgresql_configuration — the legacy configuration block

The Flexible Server equivalents are entirely different resource types:

• azurerm_postgresql_flexible_server
• azurerm_postgresql_flexible_server_configuration

Because the Rego rules never reference these types, Trivy simply never evaluates your Flexible Server configuration resources against those check IDs — hence the silent false negative. You also noticed AZU-0026 firing instead of AZU-0020 for TLS, which confirms Trivy is partially aware of Flexible Server but the rule coverage is inconsistent.

Immediate workaround — custom Rego policy

Until the built-in rules are updated you can drop a custom policy into your scan. Create policies/postgresql_flexible.rego:

  # METADATA
  # title: PostgreSQL Flexible Server — enforce SSL and connection throttling
  # description: Checks ssl_min_protocol_version and connection_throttle.enable on Flexible Server
  # scope: package
  # schemas:
  #   - input: schema["terraform"]
  # custom:
  #   id: AZU-CUSTOM-PG-FLEX-001
  #   avd_id: AZU-CUSTOM-PG-FLEX-001
  #   severity: MEDIUM

  package user.terraform.azure.postgresql.flexible

  import future.keywords.if
  import future.keywords.in

  deny[msg] if {
      config := input.values.root_module.resources[_]
      config.type == "azurerm_postgresql_flexible_server_configuration"
      config.values.name == "connection_throttle.enable"
      config.values.value != "on"
      msg := "connection_throttle.enable must be set to 'on'"
  }

  deny[msg] if {
      config := input.values.root_module.resources[_]
      config.type == "azurerm_postgresql_flexible_server_configuration"
      config.values.name == "ssl_min_protocol_version"
      config.values.value == "TLSv1"
      msg := "ssl_min_protocol_version must be TLSv1.2 or higher"
  }

  Then run:

  trivy fs --misconfig-scanners terraform \
    --policy policies/ \
    --namespaces user \
    .

Contributing a fix upstream

The built-in rules live in rules/cloud/policies/azure/database/. Adding Flexible Server coverage means adding a new rule file (or extending the existing one) that references azurerm_postgresql_flexible_server_configuration. This would be a straightforward PR — the pattern is already established in other Flexible Server checks in that directory.

[gaminginmydna7-create]

Hi @dlanov
when do you think the rules for flexible postgres server fix will be released ? based on the response we will decide if we implement custom solution.
Thank you.