Azure Database PostgreSQL Flexible Server
This page shows how to write Terraform and Azure Resource Manager for Database PostgreSQL Flexible Server and write them securely.
azurerm_postgresql_flexible_server (Terraform)
The PostgreSQL Flexible Server in Database can be configured in Terraform with the resource name azurerm_postgresql_flexible_server
. The following sections describe 9 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_postgresql_flexible_server" "gp" {
name = "example-psqlflexibleserver"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
storage_mb = 32768
resource "azurerm_postgresql_flexible_server" "gp" {
name = "example-psqlflexibleserver"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
storage_mb = 32768
resource "azurerm_postgresql_flexible_server" "gozhin" {
name = "gozhin-psqlflexibleserver-01"
resource_group_name = "__azureRG__"
location = "__azureLocation__"
version = "13"
administrator_login = "__login__"
resource "azurerm_postgresql_flexible_server" "example" {
name = "example2-flexible-server"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
version = "12"
administrator_login = "psqladminun"
resource "azurerm_postgresql_flexible_server" "example" {
name = "example1-flexible-server"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
version = "12"
administrator_login = "psqladminun"
resource "azurerm_postgresql_flexible_server" "broker_database" {
name = var.db_name
resource_group_name = azurerm_resource_group.res_group.name
location = azurerm_resource_group.res_group.location
version = "12"
delegated_subnet_id = azurerm_subnet.db_subnet.id
resource "azurerm_postgresql_flexible_server" "this" {
name = local.resource_name
resource_group_name = data.azurerm_resource_group.this.name
location = data.azurerm_resource_group.this.location
version = "12"
resource "azurerm_postgresql_flexible_server" "pgsql" {
name = var.name
location = var.location
resource_group_name = var.resource_group
delegated_subnet_id = var.vnet_create ? azurerm_subnet.pgsql[0].id : data.azurerm_subnet.pgsql[0].id
resource "azurerm_postgresql_flexible_server" "pgsql" {
name = var.name
location = var.location
resource_group_name = var.resource_group
delegated_subnet_id = var.vnet_create ? azurerm_subnet.pgsql[0].id : data.azurerm_subnet.pgsql[0].id
Parameters
The following arguments are supported:
name
- (Required) The name which should be used for this PostgreSQL Flexible Server. Changing this forces a new PostgreSQL Flexible Server to be created.
Note This must be unique across the entire Azure service, not just within the resource group.
resource_group_name
- (Required) The name of the Resource Group where the PostgreSQL Flexible Server should exist. Changing this forces a new PostgreSQL Flexible Server to be created.location
- (Required) The Azure Region where the PostgreSQL Flexible Server should exist. Changing this forces a new PostgreSQL Flexible Server to be created.administrator_login
- (Optional) The Administrator Login for the PostgreSQL Flexible Server. Required whencreate_mode
isDefault
. Changing this forces a new PostgreSQL Flexible Server to be created.administrator_password
- (Optional) The Password associated with theadministrator_login
for the PostgreSQL Flexible Server. Required whencreate_mode
isDefault
.backup_retention_days
- (Optional) The backup retention days for the PostgreSQL Flexible Server. Possible values are between7
and35
days.create_mode
- (Optional) The creation mode which can be used to restore or replicate existing servers. Possible values areDefault
andPointInTimeRestore
. Changing this forces a new PostgreSQL Flexible Server to be created.delegated_subnet_id
- (Optional) The ID of the virtual network subnet to create the PostgreSQL Flexible Server. The provided subnet should not have any other resource deployed in it and this subnet will be delegated to the PostgreSQL Flexible Server, if not already delegated. Changing this forces a new PostgreSQL Flexible Server to be created.private_dns_zone_id
- (Optional) The ID of the private dns zone to create the PostgreSQL Flexible Server. Changing this forces a new PostgreSQL Flexible Server to be created.
NOTE: There will be a breaking change from upstream service at 15th July 2021, the
private_dns_zone_id
will be required when setting adelegated_subnet_id
. For existing flexible servers who don't want to be recreated, you need to provide theprivate_dns_zone_id
to the service team to manually migrate to the specified private dns zone. Theazurerm_private_dns_zone
should end with suffix.postgres.database.azure.com
.
high_availability
- (Optional) Ahigh_availability
block as defined below.maintenance_window
- (Optional) Amaintenance_window
block as defined below.point_in_time_restore_time_in_utc
- (Optional) The point in time to restore fromcreation_source_server_id
whencreate_mode
isPointInTimeRestore
. Changing this forces a new PostgreSQL Flexible Server to be created.sku_name
- (Optional) The SKU Name for the PostgreSQL Flexible Server. The name of the SKU, follows thetier
+name
pattern (e.g.B_Standard_B1ms
,GP_Standard_D2s_v3
,MO_Standard_E4s_v3
).source_server_id
- (Optional) The resource ID of the source PostgreSQL Flexible Server to be restored. Required whencreate_mode
isPointInTimeRestore
. Changing this forces a new PostgreSQL Flexible Server to be created.storage_mb
- (Optional) The max storage allowed for the PostgreSQL Flexible Server. Possible values are32768
,65536
,131072
,262144
,524288
,1048576
,2097152
,4194304
,8388608
,16777216
, and33554432
.tags
- (Optional) A mapping of tags which should be assigned to the PostgreSQL Flexible Server.version
- (Optional) The version of PostgreSQL Flexible Server to use. Possible values are11
,12
and13
. Required whencreate_mode
isDefault
. Changing this forces a new PostgreSQL Flexible Server to be created.zone
- (Optional) The Availability Zone of the PostgreSQL Flexible Server. Possible values are1
,2
and3
.
-> Note: Azure will automatically assign an Availability Zone if one is not specified. If the PostgreSQL Flexible Server fails-over to the Standby Availability Zone, the zone
will be updated to reflect the current Primary Availability Zone. You can use Terraform's ignore_changes
functionality to ignore changes to the zone
and standby_availability_zone
fields should you wish for Terraform to not migrate the PostgreSQL Flexible Server back to it's primary Availability Zone after a fail-over.
-> Note: The Availability Zones available depend on the Azure Region that the PostgreSQL Flexible Server is being deployed into - see the Azure Availability Zones documentation for more information on which Availability Zones are available in each Azure Region.
A maintenance_window
block supports the following:
day_of_week
- (Optional) The day of week for maintenance window. Defaults to0
.start_hour
- (Optional) The day of week for maintenance window. Defaults to0
.start_minute
- (Optional) The start minute for maintenance window. Defaults to0
.
A high_availability
block supports the following:
mode
- (Required) The high availability mode for the PostgreSQL Flexible Server. The only possible value isZoneRedundant
.standby_availability_zone
- (Optional) The Availability Zone of the standby Flexible Server. Possible values are1
,2
and3
.
-> Note: Azure will automatically assign an Availability Zone if one is not specified. If the PostgreSQL Flexible Server fails-over to the Standby Availability Zone, the zone
will be updated to reflect the current Primary Availability Zone. You can use Terraform's ignore_changes
functionality to ignore changes to the zone
and standby_availability_zone
fields should you wish for Terraform to not migrate the PostgreSQL Flexible Server back to it's primary Availability Zone after a fail-over.
-> Note: The Availability Zones available depend on the Azure Region that the PostgreSQL Flexible Server is being deployed into - see the Azure Availability Zones documentation for more information on which Availability Zones are available in each Azure Region.
In addition to the Arguments listed above - the following Attributes are exported:
id
- The ID of the PostgreSQL Flexible Server.cmk_enabled
- The status showing whether the data encryption is enabled with a customer-managed key.
Note: Attribute
cmk_enabled
has been deprecated and will be removed in version 3.0 of the provider.
fqdn
- The FQDN of the PostgreSQL Flexible Server.public_network_access_enabled
- Is public network access enabled?
Explanation in Terraform Registry
Manages a PostgreSQL Flexible Server.
Tips: Best Practices for The Other Azure Database Resources
In addition to the azurerm_mariadb_firewall_rule, Azure Database has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_mariadb_firewall_rule
Ensure database firewalls do not permit public access
It is better to restrict IP address ranges that can access the database by firewall rules. If both start_ip_address and end_ip_address are set to 0.0.0.0, it blocks connections from the Internet and accepts connections from all Azure datacenter IP addresses.
azurerm_mariadb_server
Ensure that access to Azure SQL Database is restricted
It is better to disable public access to the database to avoid unwilling communications with unknown services if not required.
azurerm_mssql_database_extended_auditing_policy
Ensure to configure retention periods of database auditing to enough duration
It is better to configure retention periods of database auditing to enough duration. It would be better to set greater than at least 90 days.
azurerm_mssql_server
Ensure to enable auditing on Azure SQL databases
It is better to enable auditing on Azure SQL databases. It helps you maintain regulatory compliance, monitor the activities indicating unexpected incidents or suspected security violations.
azurerm_mssql_server_security_alert_policy
Ensure to configure at least one email address for threat alerts
It is better to configure at least one email address for threat alerts. SQL Server is able to send alerts for threat detection via emails and it could support us to notice the incident on time.
azurerm_mysql_firewall_rule
Ensure database firewalls do not permit public access
It is better to restrict IP address ranges that can access the database by firewall rules. If both start_ip_address and end_ip_address are set to 0.0.0.0, it blocks connections from the Internet and accepts connections from all Azure datacenter IP addresses.
azurerm_mysql_server
Ensure to disable public access to database
It is better to disable public access to the database to avoid unwilling communications with unknown services if not required.
azurerm_postgresql_firewall_rule
Ensure database firewalls do not permit public access
It is better to restrict IP address ranges that can access the database by firewall rules. If both start_ip_address and end_ip_address are set to 0.0.0.0, it blocks connections from the Internet and accepts connections from all Azure datacenter IP addresses.
azurerm_postgresql_server
Ensure to disable public access to database
It is better to disable public access to the database to avoid unwilling communications with unknown services if not required.
azurerm_sql_firewall_rule
Ensure database firewalls do not permit public access
It is better to restrict IP address ranges that can access the database by firewall rules. If both start_ip_address and end_ip_address are set to 0.0.0.0, it blocks connections from the Internet and accepts connections from all Azure datacenter IP addresses.
azurerm_sql_server
Ensure to enable auditing on Azure SQL databases
It is better to enable auditing on Azure SQL databases. It helps you maintain regulatory compliance, monitor the activities indicating unexpected incidents or suspected security violations.
Microsoft.DBforPostgreSQL/flexibleServers (Azure Resource Manager)
The flexibleServers in Microsoft.DBforPostgreSQL can be configured in Azure Resource Manager with the resource name Microsoft.DBforPostgreSQL/flexibleServers
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
{
"contentVersion": "1.0.0.0",
"parameters": {
"workbookDisplayName": {
"type": "string",
{
"contentVersion": "1.0.0.0",
"parameters": {
"workbookDisplayName": {
"type": "string",
Parameters
apiVersion
required - stringlocation
required - stringThe geo-location where the resource lives
name
required - stringThe name of the server.
properties
requiredadministratorLogin
optional - stringThe administrator's login name of a server. Can only be specified when the server is being created (and is required for creation).
administratorLoginPassword
optional - stringThe administrator login password (required for server creation).
availabilityZone
optional - stringavailability zone information of the server.
backup
optionalbackupRetentionDays
optional - integerBackup retention days for the server.
geoRedundantBackup
optional - stringA value indicating whether Geo-Redundant backup is enabled on the server.
createMode
optional - stringThe mode to create a new PostgreSQL server.
highAvailability
optionalmode
optional - stringThe HA mode for the server.
standbyAvailabilityZone
optional - stringavailability zone information of the standby.
maintenanceWindow
optionalcustomWindow
optional - stringindicates whether custom window is enabled or disabled
dayOfWeek
optional - integerday of week for maintenance window
startHour
optional - integerstart hour for maintenance window
startMinute
optional - integerstart minute for maintenance window
network
optionaldelegatedSubnetResourceId
optional - stringdelegated subnet arm resource id.
privateDnsZoneArmResourceId
optional - stringprivate dns zone arm resource id.
pointInTimeUTC
optional - stringRestore point creation time (ISO8601 format), specifying the time to restore from. It's required when 'createMode' is 'PointInTimeRestore'.
sourceServerResourceId
optional - stringThe source server resource ID to restore from. It's required when 'createMode' is 'PointInTimeRestore'.
storage
optionalstorageSizeGB
optional - integerMax storage allowed for a server.
version
optional - stringPostgreSQL Server version.
sku
optionalname
required - stringThe name of the sku, typically, tier + family + cores, e.g. Standard_D4s_v3.
tier
required - stringThe tier of the particular SKU, e.g. Burstable.
tags
optional - stringResource tags.
type
required - string
Frequently asked questions
What is Azure Database PostgreSQL Flexible Server?
Azure Database PostgreSQL Flexible Server is a resource for Database of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Database PostgreSQL Flexible Server?
For Terraform, the gilyas/infracost, infracost/infracost and ilya2203/Diploma_Ilia_G_17_Infra source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the lbournwhs/AzureMonitorCommunity and microsoft/AzureMonitorCommunity source code examples are useful. See the Azure Resource Manager Example section for further details.