id: azure-postgresql-geo-backup-disabled
info:
  name: Azure PostgreSQL Geo-Redundant Backup Not Enabled
  author: princechaddha
  severity: high
  description: |
    Ensure that your Microsoft Azure PostgreSQL database servers have geo-redundant backups enabled, to allow you to restore your PostgreSQL servers to a different Azure region in the event of a regional outage or a disaster.
  impact: |
    Not having geo-redundant backups enabled can lead to data loss in the event of regional failures, affecting disaster recovery capabilities.
  remediation: |
    Enable geo-redundant backups in the Azure portal or use Azure CLI to update your PostgreSQL server's backup configuration to enable geo-redundancy.
  reference:
    - https://docs.microsoft.com/en-us/azure/postgresql/concepts-backup
  tags: cloud,devops,azure,microsoft,postgresql,azure-cloud-config

flow: |
  code(1);
  for (let ServerData of iterate(template.serverList)) {
    ServerData = JSON.parse(ServerData);
    set("name", ServerData.name);
    set("resourceGroup", ServerData.resourceGroup);
    code(2);
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      az postgres server list --output json --query '[*].{"name":name, "resourceGroup":resourceGroup}'

    extractors:
      - type: json
        name: serverList
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      az postgres server show --name "$name" --resource-group "$resourceGroup" --query 'storageProfile.geoRedundantBackup'

    matchers:
      - type: word
        words:
          - '"Disabled"'

    extractors:
      - type: dsl
        dsl:
          - 'name + " in " + resourceGroup + " does not have geo-redundant backups enabled"'
# digest: 4b0a00483046022100f6970a307dfd3d1a1237313a3dfda536654833f2ae9abe2921bb753613c83268022100d138aedfd968a22e9b99b2707b4f1f5b38bc4bf47a31c9634e51480b9977e903:922c64590222798bb761d5b6d8e72950