fix(azure): read Flexible Server log retention from `logfiles.retention_days` (fixes #11757) by kratos0718 · Pull Request #11761 · prowler-cloud/prowler

kratos0718 · 2026-07-01T14:25:45Z

Description

postgresql_flexible_server_log_retention_days_greater_3 always FAILs on Azure PostgreSQL Flexible Servers.

PostgreSQL._get_log_retention_days queries the server-configuration parameter log_retention_days — but that is the Single Server name. On Flexible Server it does not exist, so client.configurations.get(...) raises ResourceNotFoundError (ConfigurationNotExists), the except branch sets log_retention_days = None, and the check reports every server as having log retention disabled.

Azure Flexible Server exposes this setting under logfiles.retention_days.

Fixes #11757.

Fix

-        resouce_group_name, server_name, "log_retention_days"
+        resouce_group_name, server_name, "logfiles.retention_days"

Test

Added test_log_retention_reads_flexible_server_parameter_name (following the existing Test_PostgreSQL_Service_Resilience pattern). It mocks configurations.get to raise ConfigurationNotExists for the old log_retention_days name and to return a value only for logfiles.retention_days. The test fails on master (retention read as None) and passes with this change.

Checklist

Root-cause bug fix (minimal, one parameter name)
Regression test added
No new dependencies

Summary by CodeRabbit

Bug Fixes
- Fixed PostgreSQL Flexible Server log retention detection to use the correct Azure configuration setting (logfiles.retention_days), preventing false failures.
- Improved reliability by gracefully handling cases where the legacy setting is unavailable.
Tests
- Added a resilience regression test to confirm the flexible server log retention value is populated correctly from the updated parameter.

…n_days postgresql_flexible_server_log_retention_days_greater_3 always failed because _get_log_retention_days queried the Single Server parameter name 'log_retention_days', which does not exist on Flexible Server. Azure then raises ConfigurationNotExists, log_retention_days is set to None, and every server is reported as having log retention disabled. Query the correct Flexible Server parameter 'logfiles.retention_days' and add a regression test. Fixes prowler-cloud#11757

coderabbitai · 2026-07-01T14:26:09Z

📝 Walkthrough

Walkthrough

The Azure PostgreSQL Flexible Server log retention lookup now uses logfiles.retention_days instead of log_retention_days, and a regression test covers the new lookup behavior. A changelog entry was added for the fix.

Changes

Log retention config key fix

Layer / File(s)	Summary
Config key correction and regression test `prowler/providers/azure/services/postgresql/postgresql_service.py`, `tests/providers/azure/services/postgresql/postgresql_service_test.py`, `prowler/CHANGELOG.md`	`_get_log_retention_days` now queries `logfiles.retention_days` while keeping the same exception handling and `None` fallback; a new test mocks the legacy key to raise `ResourceNotFoundError` and the Flexible Server key to return `"5"`, and the changelog records the fix.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: HugoPBrito, danibarranqueroo

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the Azure Flexible Server log retention fix and references the linked issue.
Linked Issues check	✅ Passed	The PR changes the Flexible Server retention lookup to `logfiles.retention_days` and adds a regression test for the reported bug.
Out of Scope Changes check	✅ Passed	The changelog note and test coverage are directly related to the bug fix; no unrelated changes are evident.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-01T14:26:22Z

✅ No Conflicts

No conflict markers, and the branch merges cleanly into its base.

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

prowler/providers/azure/services/postgresql/postgresql_service.py (1)
222-231: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Correct fix, but broad except Exception risks repeating the same silent-failure bug.

The key-name fix is correct. However, _get_log_retention_days still swallows any exception and returns None, unlike the neighboring _get_connection_throttling (Lines 213-220), which was deliberately hardened to catch only ResourceNotFoundError and let other errors propagate — precisely because silently returning None on collection failure gets misinterpreted downstream as a real (failing) retention value, which is the same class of bug this PR fixes. If logfiles.retention_days is ever missing/renamed on some server version, or the SDK call fails for another reason (permissions, throttling), this will again silently produce a false FAIL instead of surfacing the collection error.
♻️ Suggested alignment with `_get_connection_throttling`
     def _get_log_retention_days(self, subscription, resouce_group_name, server_name):
         client = self.clients[subscription]
         try:
             log_retention_days = client.configurations.get(
                 resouce_group_name, server_name, "logfiles.retention_days"
             )
-            log_retention_days = log_retention_days.value
-        except Exception:
+            log_retention_days = log_retention_days.value
+        except ResourceNotFoundError:
             log_retention_days = None
         return log_retention_days
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@prowler/providers/azure/services/postgresql/postgresql_service.py` around
lines 222 - 231, The `_get_log_retention_days` helper is still using a broad
`except Exception`, which can hide real collection failures and silently return
`None`. Update `_get_log_retention_days` in `postgresql_service.py` to match
`_get_connection_throttling` by catching only the expected not-found case for
`client.configurations.get(...)` and letting other exceptions propagate, while
preserving the existing `logfiles.retention_days` key fix.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@prowler/providers/azure/services/postgresql/postgresql_service.py`:
- Around line 222-231: The `_get_log_retention_days` helper is still using a
broad `except Exception`, which can hide real collection failures and silently
return `None`. Update `_get_log_retention_days` in `postgresql_service.py` to
match `_get_connection_throttling` by catching only the expected not-found case
for `client.configurations.get(...)` and letting other exceptions propagate,
while preserving the existing `logfiles.retention_days` key fix.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fdb81ef6-c60b-4a7d-9d0e-a240239f0ea5

📥 Commits

Reviewing files that changed from the base of the PR and between f93e165 and 5aa4906.

📒 Files selected for processing (3)

prowler/CHANGELOG.md
prowler/providers/azure/services/postgresql/postgresql_service.py
tests/providers/azure/services/postgresql/postgresql_service_test.py

codecov · 2026-07-06T15:01:58Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.56%. Comparing base (7b5d724) to head (5aa4906).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #11761      +/-   ##
==========================================
- Coverage   93.76%   89.56%   -4.21%     
==========================================
  Files         261      246      -15     
  Lines       38270     6585   -31685     
==========================================
- Hits        35885     5898   -29987     
+ Misses       2385      687    -1698

Flag	Coverage Δ
api	`?`
prowler-py3.10-azure	`89.56% <ø> (?)`
prowler-py3.11-azure	`89.38% <ø> (?)`
prowler-py3.12-azure	`89.44% <ø> (?)`
prowler-py3.13-azure	`89.33% <ø> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
prowler	`89.56% <ø> (∅)`
api	`∅ <ø> (∅)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

prowler-bot · 2026-07-07T06:20:55Z

💚 All backports created successfully

Status	Branch	Result
✅	v5.32

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details

kratos0718 requested a review from a team July 1, 2026 14:25

github-actions Bot added the provider/azure Issues/PRs related with the Azure provider label Jul 1, 2026

github-actions Bot added the community Opened by the Community label Jul 1, 2026

coderabbitai Bot previously approved these changes Jul 1, 2026

View reviewed changes

m-khan-97 mentioned this pull request Jul 1, 2026

fix(azure): query Flexible Server log retention parameter #11766

Closed

3 of 5 tasks

This was referenced Jul 6, 2026

fix(azure): query flexible server log retention parameter #11760

Closed

fix: use logfiles.retention_days for flexible servers #11762

Closed

danibarranqueroo added 2 commits July 6, 2026 16:25

Merge remote-tracking branch 'origin/master' into pr-11761

7481e4c

chore(changelog): add 5.32.2 unreleased entry for prowler-cloud#11761

5aa4906

danibarranqueroo dismissed coderabbitai[bot]’s stale review via 5aa4906 July 6, 2026 14:31

coderabbitai Bot reviewed Jul 6, 2026

View reviewed changes

coderabbitai Bot approved these changes Jul 6, 2026

View reviewed changes

danibarranqueroo added the backport-to-v5.32 Backport PR to the v5.32 branch label Jul 6, 2026

danibarranqueroo approved these changes Jul 7, 2026

View reviewed changes

danibarranqueroo merged commit 4cb02a0 into prowler-cloud:master Jul 7, 2026
42 of 44 checks passed

prowler-bot mentioned this pull request Jul 7, 2026

fix(azure): read Flexible Server log retention from logfiles.retention_days (fixes #11757) #11863

Merged

prowler-bot added the was-backported The PR was successfully backported to the target branch label Jul 7, 2026

Navigation Menu

Repository navigation

fix(azure): read Flexible Server log retention from `logfiles.retention_days` (fixes #11757) - #11761

fix(azure): read Flexible Server log retention from `logfiles.retention_days` (fixes #11757)#11761
danibarranqueroo merged 3 commits into
prowler-cloud:masterfrom
kratos0718:fix/azure-postgres-flexible-log-retention-param

kratos0718 commented Jul 1, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 1, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Jul 1, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

codecov Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

prowler-bot commented Jul 7, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

kratos0718 commented Jul 1, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Fix

Test

Checklist

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

prowler-bot commented Jul 7, 2026

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kratos0718 commented Jul 1, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 1, 2026 •

edited

Loading

github-actions Bot commented Jul 1, 2026 •

edited

Loading

codecov Bot commented Jul 6, 2026 •

edited

Loading