PostgreSQL servers should have 'log_checkpoints' set to 'ON'
Checks PostgreSQL servers for the `log_checkpoints` setting. The Azure Policy audits PostgreSQL databases without `log_checkpoints` enabled, while KICS and Trivy each require the parameter `log_checkpoints` to be set to `ON`.
Postgresql can generate logs for checkpoints to improve visibility for audit and configuration issue resolution.
What this control checks
PostgreSQL servers that have checkpoint logging turned on pass; servers with it off fail
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Log checkpoints should be enabled for PostgreSQL database servers" (eb6f77b9-bd53-4e35-a23d-7f65d5f0e43d); PowerPipe control azure_compliance.control.postgres_db_server_log_checkpoints_on.
Scans of the Terraform code that flag the same setting before deployment: KICS query "PostgreSQL Log Checkpoints Disabled" (3790d386-be81-4dcf-9850-eaa7df6c10d9); Trivy check AZU-0024.
Framework-specific interpretation
RBI IT Framework for NBFCs: Mapped to 3.1.g (Trails).
CIS Azure Benchmark v1.3.0: Mapped to 4.3.3 (Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server).
CIS Azure Benchmark v1.4.0: Mapped to 4.3.2 (Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server).
CIS Azure Benchmark v1.5.0: Mapped to 4.3.2 (Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server).
CIS Azure Benchmark v2.0.0: Mapped to 4.3.2 (Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server).
CIS Azure Benchmark v2.1.0: Mapped to 4.3.2 (Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.1.g Trails
- 4.3.3 Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server
- 4.3.2 Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server
- 4.3.2 Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server
- 4.3.2 Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server
- 4.3.2 Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
postgres_db_server_log_checkpoints_on - Powerpipe Control:
azure_compliance.control.postgres_db_server_log_checkpoints_on - Azure Policy Definition:
eb6f77b9-bd53-4e35-a23d-7f65d5f0e43d - KICS Query:
3790d386-be81-4dcf-9850-eaa7df6c10d9 - Trivy Check:
AZU-0024
Last reviewed: 2026-10-14