fix(azure): read Flexible Server log retention from logfiles.retention_days (fixes #11757) (#11761)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>

prowler/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to the **Prowler SDK** are documented in this file.
 
+## [5.32.2] (Prowler UNRELEASED)
+
+### 🐞 Fixed
+
+- Azure `postgresql_flexible_server_log_retention_days_greater_3` check now queries the `logfiles.retention_days` configuration parameter instead of `log_retention_days` (which only exists on the retired Single Server), fixing false `FAIL` results on every Flexible Server regardless of the actual retention value [(#11761)](https://github.com/prowler-cloud/prowler/pull/11761)
+
+---
+
 ## [5.32.1] (Prowler v5.32.1)
 
 ### 🐞 Fixed

prowler/providers/azure/services/postgresql/postgresql_service.py

@@ -223,7 +223,7 @@ class PostgreSQL(AzureService):
         client = self.clients[subscription]
         try:
             log_retention_days = client.configurations.get(
-                resouce_group_name, server_name, "log_retention_days"
+                resouce_group_name, server_name, "logfiles.retention_days"
             )
             log_retention_days = log_retention_days.value
         except Exception:

tests/providers/azure/services/postgresql/postgresql_service_test.py

@@ -402,6 +402,42 @@ class Test_PostgreSQL_Service_Resilience:
         dev_server = next(s for s in servers[AZURE_SUBSCRIPTION_ID] if s.name == "dev")
         assert dev_server.connection_throttling == "ON"
 
+    def test_log_retention_reads_flexible_server_parameter_name(self):
+        # Azure Flexible Server exposes log retention under the parameter
+        # "logfiles.retention_days". The legacy Single Server name
+        # "log_retention_days" does not exist on Flexible Server (Azure raises
+        # ConfigurationNotExists), which previously left log_retention_days=None
+        # and made postgresql_flexible_server_log_retention_days_greater_3 always
+        # FAIL. Regression test for #11757.
+        dev = _make_server("dev")
+
+        mock_client = MagicMock()
+        mock_client.servers.list.return_value = [dev]
+        server_details = MagicMock()
+        server_details.location = "westeurope"
+        mock_client.servers.get.return_value = server_details
+        mock_client.administrators.list_by_server.return_value = []
+        mock_client.firewall_rules.list_by_server.return_value = []
+
+        def configurations_get(resource_group, server_name, key):
+            if key == "log_retention_days":
+                raise ResourceNotFoundError(
+                    "(ConfigurationNotExists) The configuration "
+                    "'log_retention_days' does not exist for dev server "
+                    "version 18."
+                )
+            if key == "logfiles.retention_days":
+                return MagicMock(value="5")
+            return MagicMock(value="ON")
+
+        mock_client.configurations.get.side_effect = configurations_get
+
+        postgresql = self._build_service_with_client(mock_client)
+        servers = postgresql._get_flexible_servers()
+
+        dev_server = servers[AZURE_SUBSCRIPTION_ID][0]
+        assert dev_server.log_retention_days == "5"
+
     def test_unexpected_throttling_error_is_not_silently_collected(self):
         # An unexpected failure reading "connection_throttle.enable" (e.g. a
         # permission, throttling, or transient SDK error) must NOT be turned