Add pgaudit audit logging with 90-day diagnostic storage retention for compliance

Author: tjementum

cloud-infrastructure/cluster/grant-database-permissions.sh

@@ -35,8 +35,12 @@ END
 \$\$;
 EOF
 
-PGPASSWORD=$ACCESS_TOKEN psql -v ON_ERROR_STOP=1 "host=$POSTGRES_HOST dbname=$DATABASE_NAME user='$ENTRA_USER' sslmode=verify-full sslrootcert=system" << EOF
+PGPASSWORD=$ACCESS_TOKEN psql "host=$POSTGRES_HOST dbname=$DATABASE_NAME user='$ENTRA_USER' sslmode=verify-full sslrootcert=system" << EOF
 CREATE EXTENSION IF NOT EXISTS pg_stat_statements;
+CREATE EXTENSION IF NOT EXISTS pgaudit;
+EOF
+
+PGPASSWORD=$ACCESS_TOKEN psql -v ON_ERROR_STOP=1 "host=$POSTGRES_HOST dbname=$DATABASE_NAME user='$ENTRA_USER' sslmode=verify-full sslrootcert=system" << EOF
 GRANT CONNECT ON DATABASE "$DATABASE_NAME" TO "$MANAGED_IDENTITY_NAME";
 GRANT USAGE ON SCHEMA public TO "$MANAGED_IDENTITY_NAME";
 GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO "$MANAGED_IDENTITY_NAME";

cloud-infrastructure/cluster/main-cluster.bicep

@@ -57,6 +57,15 @@ module diagnosticStorageAccount '../modules/storage-account.bicep' = {
   }
 }
 
+module diagnosticStorageRetention '../modules/storage-account-retention.bicep' = {
+  scope: clusterResourceGroup
+  name: '${clusterResourceGroupName}-diagnostic-storage-retention'
+  params: {
+    storageAccountName: diagnosticStorageAccount.outputs.name
+    retentionDays: 90
+  }
+}
+
 module virtualNetwork '../modules/virtual-network.bicep' = {
   scope: clusterResourceGroup
   name: '${clusterResourceGroupName}-virtual-network'
@@ -143,6 +152,7 @@ module postgresServer '../modules/postgresql-flexible-server.bicep' = {
     subnetId: virtualNetwork.outputs.privateEndpointSubnetId
     virtualNetworkId: virtualNetwork.outputs.virtualNetworkId
     isProduction: environment == 'prod'
+    diagnosticStorageAccountId: diagnosticStorageAccount.outputs.storageAccountId
   }
 }
 

cloud-infrastructure/modules/postgresql-flexible-server.bicep

@@ -5,6 +5,7 @@ param tenantId string
 param subnetId string
 param virtualNetworkId string
 param isProduction bool
+param diagnosticStorageAccountId string
 
 resource postgresServer 'Microsoft.DBforPostgreSQL/flexibleServers@2025-08-01' = {
   name: name
@@ -103,20 +104,55 @@ resource extensionsConfig 'Microsoft.DBforPostgreSQL/flexibleServers/configurati
   name: 'azure.extensions'
   dependsOn: [privateDnsZoneGroup]
   properties: {
-    value: 'pg_stat_statements'
+    value: 'pg_stat_statements,pgaudit'
+    source: 'user-override'
+  }
+}
+
+resource sharedPreloadLibrariesConfig 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2025-08-01' = {
+  parent: postgresServer
+  name: 'shared_preload_libraries'
+  dependsOn: [extensionsConfig]
+  properties: {
+    value: 'pgaudit'
+    source: 'user-override'
+  }
+}
+
+resource pgauditLogConfig 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2025-08-01' = {
+  parent: postgresServer
+  name: 'pgaudit.log'
+  dependsOn: [sharedPreloadLibrariesConfig]
+  properties: {
+    value: 'WRITE,DDL,ROLE'
     source: 'user-override'
   }
 }
 
 resource walLevelConfig 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2025-08-01' = {
   parent: postgresServer
   name: 'wal_level'
-  dependsOn: [extensionsConfig]
+  dependsOn: [pgauditLogConfig]
   properties: {
     value: 'logical'
     source: 'user-override'
   }
 }
 
+resource diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
+  name: '${name}-postgres-diagnostics'
+  scope: postgresServer
+  dependsOn: [walLevelConfig]
+  properties: {
+    storageAccountId: diagnosticStorageAccountId
+    logs: [
+      {
+        categoryGroup: 'allLogs'
+        enabled: true
+      }
+    ]
+  }
+}
+
 output serverName string = postgresServer.name
 output serverFqdn string = postgresServer.properties.fullyQualifiedDomainName

cloud-infrastructure/modules/storage-account-retention.bicep

@@ -0,0 +1,34 @@
+param storageAccountName string
+param retentionDays int
+
+resource storageAccount 'Microsoft.Storage/storageAccounts@2025-06-01' existing = {
+  name: storageAccountName
+}
+
+resource lifecyclePolicy 'Microsoft.Storage/storageAccounts/managementPolicies@2025-06-01' = {
+  parent: storageAccount
+  name: 'default'
+  properties: {
+    policy: {
+      rules: [
+        {
+          name: 'delete-after-${retentionDays}-days'
+          enabled: true
+          type: 'Lifecycle'
+          definition: {
+            actions: {
+              baseBlob: {
+                delete: {
+                  daysAfterModificationGreaterThan: retentionDays
+                }
+              }
+            }
+            filters: {
+              blobTypes: ['blockBlob', 'appendBlob']
+            }
+          }
+        }
+      ]
+    }
+  }
+}