PostgreSQL flexible servers should have 'require_secure_transport' set to 'ON'
Checks that PostgreSQL flexible servers have `require_secure_transport` set to `ON`. Enforcing SSL connections between the database flexible server and client applications helps protect against 'man in the middle' attacks by encrypting the data stream.
Enforcing SSL connections between your database flexible server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. Without enforced TLS, clients may connect in plaintext or with weak settings, exposing credentials and data to man-in-the-middle, query tampering, and session hijacking.
What this control checks
PostgreSQL flexible servers must require encrypted client connections
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Enforce SSL connection should be enabled for PostgreSQL flexible servers" (c29c38cb-74a7-4505-9a06-e588ab86620a); Prowler check postgresql_flexible_server_enforce_ssl_enabled (prowler azure --checks postgresql_flexible_server_enforce_ssl_enabled); PowerPipe control azure_compliance.control.postgres_sql_flexible_server_ssl_enabled.
Framework-specific interpretation
SOC 2: Mapped to CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- 4.3.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server
- 4.3.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server
- 5.2.1 Ensure server parameter 'require_secure_transport' is set to 'ON' for PostgreSQL flexible server
- 5.3.1 Ensure server parameter 'require_secure_transport' is set to 'ON' for MySQL flexible server
- 164.312(e)(1) Transmission security
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
postgres_sql_flexible_server_ssl_enabled - Powerpipe Control:
azure_compliance.control.postgres_sql_flexible_server_ssl_enabled - Prowler Check:
postgresql_flexible_server_enforce_ssl_enabled - Azure Policy Definition:
c29c38cb-74a7-4505-9a06-e588ab86620a
Last reviewed: 2026-10-14