Azure Database PostgreSQL Flexible Server

azurerm_postgresql_flexible_server (Terraform)

The PostgreSQL Flexible Server in Database can be configured in Terraform with the resource name azurerm_postgresql_flexible_server. The following sections describe 9 examples of how to use the resource and its parameters.

Example Usage from GitHub

gilyas/infracost

resource "azurerm_postgresql_flexible_server" "gp" {
  name                = "example-psqlflexibleserver"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  storage_mb          = 32768

infracost/infracost

resource "azurerm_postgresql_flexible_server" "gp" {
  name                = "example-psqlflexibleserver"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  storage_mb          = 32768

ilya2203/Diploma_Ilia_G_17_Infra

resource "azurerm_postgresql_flexible_server" "gozhin" {
  name                   = "gozhin-psqlflexibleserver-01"
  resource_group_name    = "__azureRG__"
  location               = "__azureLocation__"
  version                = "13"
  administrator_login    = "__login__"

wasfree/azure-support

resource "azurerm_postgresql_flexible_server" "example" {
  name                   = "example2-flexible-server"
  resource_group_name    = azurerm_resource_group.example.name
  location               = azurerm_resource_group.example.location
  version                = "12"
  administrator_login    = "psqladminun"

wasfree/azure-support

resource "azurerm_postgresql_flexible_server" "example" {
  name                   = "example1-flexible-server"
  resource_group_name    = azurerm_resource_group.example.name
  location               = azurerm_resource_group.example.location
  version                = "12"
  administrator_login    = "psqladminun"

avfaulkner/connection-broker-infra-azure

resource "azurerm_postgresql_flexible_server" "broker_database" {
  name                   = var.db_name
  resource_group_name    = azurerm_resource_group.res_group.name
  location               = azurerm_resource_group.res_group.location
  version                = "12"
  delegated_subnet_id    = azurerm_subnet.db_subnet.id

nuuday/terraform-k8s-grafana

resource "azurerm_postgresql_flexible_server" "this" {
  name                = local.resource_name
  resource_group_name = data.azurerm_resource_group.this.name
  location            = data.azurerm_resource_group.this.location

  version = "12"

canada-ca-terraform-modules/terraform-azurerm-flex-postgresql

resource "azurerm_postgresql_flexible_server" "pgsql" {
  name                = var.name
  location            = var.location
  resource_group_name = var.resource_group

  delegated_subnet_id = var.vnet_create ? azurerm_subnet.pgsql[0].id : data.azurerm_subnet.pgsql[0].id

StatCan/terraform-azurerm-flex-postgresql

resource "azurerm_postgresql_flexible_server" "pgsql" {
  name                = var.name
  location            = var.location
  resource_group_name = var.resource_group

  delegated_subnet_id = var.vnet_create ? azurerm_subnet.pgsql[0].id : data.azurerm_subnet.pgsql[0].id

Parameters

The following arguments are supported:

• name - (Required) The name which should be used for this PostgreSQL Flexible Server. Changing this forces a new PostgreSQL Flexible Server to be created.

Note This must be unique across the entire Azure service, not just within the resource group.

• resource_group_name - (Required) The name of the Resource Group where the PostgreSQL Flexible Server should exist. Changing this forces a new PostgreSQL Flexible Server to be created.

• location - (Required) The Azure Region where the PostgreSQL Flexible Server should exist. Changing this forces a new PostgreSQL Flexible Server to be created.

• administrator_login - (Optional) The Administrator Login for the PostgreSQL Flexible Server. Required when create_mode is Default. Changing this forces a new PostgreSQL Flexible Server to be created.

• administrator_password - (Optional) The Password associated with the administrator_login for the PostgreSQL Flexible Server. Required when create_mode is Default.

• backup_retention_days - (Optional) The backup retention days for the PostgreSQL Flexible Server. Possible values are between 7 and 35 days.

• create_mode - (Optional) The creation mode which can be used to restore or replicate existing servers. Possible values are Default and PointInTimeRestore. Changing this forces a new PostgreSQL Flexible Server to be created.

• delegated_subnet_id - (Optional) The ID of the virtual network subnet to create the PostgreSQL Flexible Server. The provided subnet should not have any other resource deployed in it and this subnet will be delegated to the PostgreSQL Flexible Server, if not already delegated. Changing this forces a new PostgreSQL Flexible Server to be created.

• private_dns_zone_id - (Optional) The ID of the private dns zone to create the PostgreSQL Flexible Server. Changing this forces a new PostgreSQL Flexible Server to be created.

NOTE: There will be a breaking change from upstream service at 15th July 2021, the private_dns_zone_id will be required when setting a delegated_subnet_id. For existing flexible servers who don't want to be recreated, you need to provide the private_dns_zone_id to the service team to manually migrate to the specified private dns zone. The azurerm_private_dns_zone should end with suffix .postgres.database.azure.com.

• high_availability - (Optional) A high_availability block as defined below.

• maintenance_window - (Optional) A maintenance_window block as defined below.

• point_in_time_restore_time_in_utc - (Optional) The point in time to restore from creation_source_server_id when create_mode is PointInTimeRestore. Changing this forces a new PostgreSQL Flexible Server to be created.

• sku_name - (Optional) The SKU Name for the PostgreSQL Flexible Server. The name of the SKU, follows the tier + name pattern (e.g. B_Standard_B1ms, GP_Standard_D2s_v3, MO_Standard_E4s_v3).

• source_server_id - (Optional) The resource ID of the source PostgreSQL Flexible Server to be restored. Required when create_mode is PointInTimeRestore. Changing this forces a new PostgreSQL Flexible Server to be created.

• storage_mb - (Optional) The max storage allowed for the PostgreSQL Flexible Server. Possible values are 32768, 65536, 131072, 262144, 524288, 1048576, 2097152, 4194304, 8388608, 16777216, and 33554432.

• tags - (Optional) A mapping of tags which should be assigned to the PostgreSQL Flexible Server.

• version - (Optional) The version of PostgreSQL Flexible Server to use. Possible values are 11,12 and 13. Required when create_mode is Default. Changing this forces a new PostgreSQL Flexible Server to be created.

• zone - (Optional) The Availability Zone of the PostgreSQL Flexible Server. Possible values are 1, 2 and 3.

-> Note: Azure will automatically assign an Availability Zone if one is not specified. If the PostgreSQL Flexible Server fails-over to the Standby Availability Zone, the zone will be updated to reflect the current Primary Availability Zone. You can use Terraform's ignore_changes functionality to ignore changes to the zone and standby_availability_zone fields should you wish for Terraform to not migrate the PostgreSQL Flexible Server back to it's primary Availability Zone after a fail-over.

-> Note: The Availability Zones available depend on the Azure Region that the PostgreSQL Flexible Server is being deployed into - see the Azure Availability Zones documentation for more information on which Availability Zones are available in each Azure Region.

A maintenance_window block supports the following:

• day_of_week - (Optional) The day of week for maintenance window. Defaults to 0.

• start_hour - (Optional) The day of week for maintenance window. Defaults to 0.

• start_minute - (Optional) The start minute for maintenance window. Defaults to 0.

A high_availability block supports the following:

• mode - (Required) The high availability mode for the PostgreSQL Flexible Server. The only possible value is ZoneRedundant.

• standby_availability_zone - (Optional) The Availability Zone of the standby Flexible Server. Possible values are 1, 2 and 3.

-> Note: Azure will automatically assign an Availability Zone if one is not specified. If the PostgreSQL Flexible Server fails-over to the Standby Availability Zone, the zone will be updated to reflect the current Primary Availability Zone. You can use Terraform's ignore_changes functionality to ignore changes to the zone and standby_availability_zone fields should you wish for Terraform to not migrate the PostgreSQL Flexible Server back to it's primary Availability Zone after a fail-over.

-> Note: The Availability Zones available depend on the Azure Region that the PostgreSQL Flexible Server is being deployed into - see the Azure Availability Zones documentation for more information on which Availability Zones are available in each Azure Region.

In addition to the Arguments listed above - the following Attributes are exported:

• id - The ID of the PostgreSQL Flexible Server.

• cmk_enabled - The status showing whether the data encryption is enabled with a customer-managed key.

Note: Attribute cmk_enabled has been deprecated and will be removed in version 3.0 of the provider.

• fqdn - The FQDN of the PostgreSQL Flexible Server.

• public_network_access_enabled - Is public network access enabled?

Explanation in Terraform Registry

Manages a PostgreSQL Flexible Server.

Tips: Best Practices for The Other Azure Database Resources

In addition to the azurerm_mariadb_firewall_rule, Azure Database has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

azurerm_mariadb_firewall_rule

Ensure database firewalls do not permit public access

It is better to restrict IP address ranges that can access the database by firewall rules. If both start_ip_address and end_ip_address are set to 0.0.0.0, it blocks connections from the Internet and accepts connections from all Azure datacenter IP addresses.

azurerm_mariadb_server

Ensure that access to Azure SQL Database is restricted

It is better to disable public access to the database to avoid unwilling communications with unknown services if not required.

azurerm_mssql_database_extended_auditing_policy

Ensure to configure retention periods of database auditing to enough duration

It is better to configure retention periods of database auditing to enough duration. It would be better to set greater than at least 90 days.

azurerm_mssql_server

Ensure to enable auditing on Azure SQL databases

It is better to enable auditing on Azure SQL databases. It helps you maintain regulatory compliance, monitor the activities indicating unexpected incidents or suspected security violations.

azurerm_mssql_server_security_alert_policy

Ensure to configure at least one email address for threat alerts

It is better to configure at least one email address for threat alerts. SQL Server is able to send alerts for threat detection via emails and it could support us to notice the incident on time.

azurerm_mysql_firewall_rule

Ensure database firewalls do not permit public access

It is better to restrict IP address ranges that can access the database by firewall rules. If both start_ip_address and end_ip_address are set to 0.0.0.0, it blocks connections from the Internet and accepts connections from all Azure datacenter IP addresses.

azurerm_mysql_server

Ensure to disable public access to database

It is better to disable public access to the database to avoid unwilling communications with unknown services if not required.

azurerm_postgresql_firewall_rule

Ensure database firewalls do not permit public access

It is better to restrict IP address ranges that can access the database by firewall rules. If both start_ip_address and end_ip_address are set to 0.0.0.0, it blocks connections from the Internet and accepts connections from all Azure datacenter IP addresses.

azurerm_postgresql_server

Ensure to disable public access to database

It is better to disable public access to the database to avoid unwilling communications with unknown services if not required.

azurerm_sql_firewall_rule

Ensure database firewalls do not permit public access

It is better to restrict IP address ranges that can access the database by firewall rules. If both start_ip_address and end_ip_address are set to 0.0.0.0, it blocks connections from the Internet and accepts connections from all Azure datacenter IP addresses.

azurerm_sql_server

Ensure to enable auditing on Azure SQL databases

It is better to enable auditing on Azure SQL databases. It helps you maintain regulatory compliance, monitor the activities indicating unexpected incidents or suspected security violations.