PostgreSQL servers should have 'log_retention_days' set to greater than 3 days
Checks that PostgreSQL servers keep logs long enough. KICS checks if the PostgreSQL Database Server retains logs for less than 3 Days. The Powerpipe check ensures server parameter 'log_retention_days' is greater than 3 days.
What this control checks
PostgreSQL server parameter 'log_retention_days' must be greater than 3 days.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.postgres_db_server_log_retention_days_3.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Small PostgreSQL DB Server Log Retention Period" (261a83f8-dd72-4e8c-b5e1-ebf06e8fe606).
Framework-specific interpretation
CIS Azure Benchmark v1.3.0: Mapped to 4.3.7 (Ensure server parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server).
CIS Azure Benchmark v1.4.0: Mapped to 4.3.6 (Ensure server parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server).
CIS Azure Benchmark v1.5.0: Mapped to 4.3.6 (Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server).
CIS Azure Benchmark v2.0.0: Mapped to 4.3.6 (Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server).
CIS Azure Benchmark v2.1.0: Mapped to 4.3.6 (Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server).
Framework mappings
The clauses this control is mapped to in each framework.
- 4.3.7 Ensure server parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server
- 4.3.6 Ensure server parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server
- 4.3.6 Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server
- 4.3.6 Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server
- 4.3.6 Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
postgres_db_server_log_retention_days_3 - Powerpipe Control:
azure_compliance.control.postgres_db_server_log_retention_days_3 - KICS Query:
261a83f8-dd72-4e8c-b5e1-ebf06e8fe606
Last reviewed: 2026-10-14