Description

Detects Azure PostgreSQL databases that have SSL enforcement disabled, which allows unencrypted connections to the database. Without SSL enforcement, sensitive data transmitted between clients and the database server could be exposed to man-in-the-middle attacks and eavesdropping.

Detection Strategy

• Checks the SSL enforcement configuration for each Azure PostgreSQL database server

• Reports a vulnerability if the 'ssl_enforcement' setting is not set to 'Enabled'

• The check examines the database server configuration at the server level, since SSL enforcement is a server-wide setting