SSL Enforce Disabled

  • Query id: 961ce567-a16d-4d7d-9027-f0ec2628a555
  • Query name: SSL Enforce Disabled
  • Platform: Ansible
  • Severity: High
  • Category: Encryption
  • URL: Github

Description

Make sure that for PosgreSQL, the 'Enforce SSL connection' is set to 'ENABLED'
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - yaml file
- name: Create (or update) PostgreSQL Server
  azure.azcollection.azure_rm_postgresqlserver:
    resource_group: myResourceGroup
    name: testserver
    sku:
      name: B_Gen5_1
      tier: Basic
    location: eastus
    storage_mb: 1024
    admin_username: cloudsa
    admin_password: password
- name: Create (or update) PostgreSQL Server2
  azure.azcollection.azure_rm_postgresqlserver:
    resource_group: myResourceGroup
    name: testserver
    sku:
      name: B_Gen5_1
      tier: Basic
    location: eastus
    storage_mb: 1024
    enforce_ssl: no
    admin_username: cloudsa
    admin_password: password

Code samples without security vulnerabilities

Negative test num. 1 - yaml file
- name: Create (or update) PostgreSQL Server
  azure.azcollection.azure_rm_postgresqlserver:
    resource_group: myResourceGroup
    name: testserver
    sku:
      name: B_Gen5_1
      tier: Basic
    location: eastus
    storage_mb: 1024
    enforce_ssl: yes
    admin_username: cloudsa
    admin_password: password
- name: Create (or update) PostgreSQL Server2
  azure.azcollection.azure_rm_postgresqlserver:
    resource_group: myResourceGroup
    name: testserver
    sku:
      name: B_Gen5_1
      tier: Basic
    location: eastus
    storage_mb: 1024
    enforce_ssl: Yes
    admin_username: cloudsa
    admin_password: password
- name: Create (or update) PostgreSQL Server3
  azure.azcollection.azure_rm_postgresqlserver:
    resource_group: myResourceGroup
    name: testserver
    sku:
      name: B_Gen5_1
      tier: Basic
    location: eastus
    storage_mb: 1024
    enforce_ssl: true
    admin_username: cloudsa
    admin_password: password
- name: Create (or update) PostgreSQL Server4
  azure.azcollection.azure_rm_postgresqlserver:
    resource_group: myResourceGroup
    name: testserver
    sku:
      name: B_Gen5_1
      tier: Basic
    location: eastus
    storage_mb: 1024
    enforce_ssl: true
    admin_username: cloudsa
    admin_password: password
- name: Create (or update) PostgreSQL Server5
  azure.azcollection.azure_rm_postgresqlserver:
    resource_group: myResourceGroup
    name: testserver
    sku:
      name: B_Gen5_1
      tier: Basic
    location: eastus
    storage_mb: 1024
    enforce_ssl: yes
    admin_username: cloudsa
    admin_password: password
- name: Create (or update) PostgreSQL Server6
  azure.azcollection.azure_rm_postgresqlserver:
    resource_group: myResourceGroup
    name: testserver
    sku:
      name: B_Gen5_1
      tier: Basic
    location: eastus
    storage_mb: 1024
    enforce_ssl: Yes
    admin_username: cloudsa
    admin_password: password
- name: Create (or update) PostgreSQL Server7
  azure.azcollection.azure_rm_postgresqlserver:
    resource_group: myResourceGroup
    name: testserver
    sku:
      name: B_Gen5_1
      tier: Basic
    location: eastus
    storage_mb: 1024
    enforce_ssl: 'true'
    admin_username: cloudsa
    admin_password: password
- name: Create (or update) PostgreSQL Server8
  azure.azcollection.azure_rm_postgresqlserver:
    resource_group: myResourceGroup
    name: testserver
    sku:
      name: B_Gen5_1
      tier: Basic
    location: eastus
    storage_mb: 1024
    enforce_ssl: 'True'
    admin_username: cloudsa
    admin_password: password