Description:

This check verifies that Infrastructure Double Encryption is enabled for Azure Database for PostgreSQL servers. Infrastructure encryption provides an additional layer of encryption at rest on top of the default storage encryption, ensuring that data is encrypted twice using separate encryption layers before being written to disk.


Rationale:

Azure Database for PostgreSQL encrypts data at rest by default. Enabling Infrastructure Double Encryption adds a second encryption layer, providing enhanced protection for sensitive data and helping organizations meet stringent security and compliance requirements. This defense-in-depth approach reduces the risk of a single encryption layer being compromised.


Impact:

  • Provides an additional layer of encryption for data at rest.

  • Enhances protection of sensitive and regulated data.

  • Supports compliance requirements that mandate dual-layer encryption.

  • Improves overall data security posture.

  • May slightly increase storage-related processing overhead, though the impact is generally minimal.


Default Value:

Infrastructure Double Encryption is not enabled by default for all PostgreSQL deployments and must be configured during server creation. For many Azure Database for PostgreSQL deployment models, this setting cannot be modified after the server has been provisioned.


Remediation:

Test Plan:

Using Azure Portal

  1. Sign in to the Azure Portal.

  2. Navigate to Azure Database for PostgreSQL.

  3. Select the PostgreSQL server.

  4. Under Settings, select Encryption.

  5. Review the Infrastructure Encryption configuration.

  6. Verify that the setting is enabled.


Implementation steps:

Using Azure Portal

For New PostgreSQL Servers

  1. Sign in to the Azure Portal.

  2. Select Create Azure Database for PostgreSQL.

  3. Configure the required server settings.

  4. Navigate to the Encryption section during deployment.

  5. Enable:

     Infrastructure Encryption

  6. Complete the server deployment.

  7. Verify the server is created with Infrastructure Double Encryption enabled.


Backout Plan:

  1. If application or migration issues occur, redirect applications back to the original PostgreSQL server.

  2. Restore database connections and dependent services to the previous environment.

  3. Validate application functionality and database operations.

  4. Troubleshoot migration or configuration issues before reattempting deployment with Infrastructure Encryption enabled.

Note: Infrastructure Double Encryption typically cannot be disabled after a server has been provisioned with the feature enabled. Backout generally involves reverting workloads to the original server rather than changing the encryption setting.


References: