From 4cb02a0ead7f1fca24d5064ef907b0975ce27601 Mon Sep 17 00:00:00 2001 From: Abhinav Date: Tue, 7 Jul 2026 11:49:44 +0530 Subject: [PATCH] fix(azure): read Flexible Server log retention from `logfiles.retention_days` (fixes #11757) (#11761) Co-authored-by: Daniel Barranquero --- prowler/CHANGELOG.md | 8 +++++ .../services/postgresql/postgresql_service.py | 2 +- .../postgresql/postgresql_service_test.py | 36 +++++++++++++++++++ 3 files changed, 45 insertions(+), 1 deletion(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 3a12c814da..6dd2054c1e 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -2,6 +2,14 @@ All notable changes to the **Prowler SDK** are documented in this file. +## [5.32.2] (Prowler UNRELEASED) + +### 🐞 Fixed + +- Azure `postgresql_flexible_server_log_retention_days_greater_3` check now queries the `logfiles.retention_days` configuration parameter instead of `log_retention_days` (which only exists on the retired Single Server), fixing false `FAIL` results on every Flexible Server regardless of the actual retention value [(#11761)](https://github.com/prowler-cloud/prowler/pull/11761) + +--- + ## [5.32.1] (Prowler v5.32.1) ### 🐞 Fixed diff --git a/prowler/providers/azure/services/postgresql/postgresql_service.py b/prowler/providers/azure/services/postgresql/postgresql_service.py index e7fe98fe79..59881da09b 100644 --- a/prowler/providers/azure/services/postgresql/postgresql_service.py +++ b/prowler/providers/azure/services/postgresql/postgresql_service.py @@ -223,7 +223,7 @@ class PostgreSQL(AzureService): client = self.clients[subscription] try: log_retention_days = client.configurations.get( - resouce_group_name, server_name, "log_retention_days" + resouce_group_name, server_name, "logfiles.retention_days" ) log_retention_days = log_retention_days.value except Exception: diff --git a/tests/providers/azure/services/postgresql/postgresql_service_test.py b/tests/providers/azure/services/postgresql/postgresql_service_test.py index c9fea2b307..2e002bcfde 100644 --- a/tests/providers/azure/services/postgresql/postgresql_service_test.py +++ b/tests/providers/azure/services/postgresql/postgresql_service_test.py @@ -402,6 +402,42 @@ class Test_PostgreSQL_Service_Resilience: dev_server = next(s for s in servers[AZURE_SUBSCRIPTION_ID] if s.name == "dev") assert dev_server.connection_throttling == "ON" + def test_log_retention_reads_flexible_server_parameter_name(self): + # Azure Flexible Server exposes log retention under the parameter + # "logfiles.retention_days". The legacy Single Server name + # "log_retention_days" does not exist on Flexible Server (Azure raises + # ConfigurationNotExists), which previously left log_retention_days=None + # and made postgresql_flexible_server_log_retention_days_greater_3 always + # FAIL. Regression test for #11757. + dev = _make_server("dev") + + mock_client = MagicMock() + mock_client.servers.list.return_value = [dev] + server_details = MagicMock() + server_details.location = "westeurope" + mock_client.servers.get.return_value = server_details + mock_client.administrators.list_by_server.return_value = [] + mock_client.firewall_rules.list_by_server.return_value = [] + + def configurations_get(resource_group, server_name, key): + if key == "log_retention_days": + raise ResourceNotFoundError( + "(ConfigurationNotExists) The configuration " + "'log_retention_days' does not exist for dev server " + "version 18." + ) + if key == "logfiles.retention_days": + return MagicMock(value="5") + return MagicMock(value="ON") + + mock_client.configurations.get.side_effect = configurations_get + + postgresql = self._build_service_with_client(mock_client) + servers = postgresql._get_flexible_servers() + + dev_server = servers[AZURE_SUBSCRIPTION_ID][0] + assert dev_server.log_retention_days == "5" + def test_unexpected_throttling_error_is_not_silently_collected(self): # An unexpected failure reading "connection_throttle.enable" (e.g. a # permission, throttling, or transient SDK error) must NOT be turned