Manage Azure PostgreSQL Flexible Servers with .NET

This skill provisions and manages Azure Database for PostgreSQL Flexible Server via Azure Resource Manager using Azure.ResourceManager.PostgreSql (v1.2.0 GA, API version 2023-12-01-preview) plus Azure.Identity, explicitly scoped to Flexible Server only since Single Server is deprecated and scheduled for retirement. Through an ArmClient authenticated with DefaultAzureCredential, the resource hierarchy is Subscription → ResourceGroup → PostgreSqlFlexibleServer, which owns databases, IP firewall rules, server-parameter configurations, backups, an Entra ID administrator, and read-replica virtual endpoints. Eleven core workflows are covered: creating a server (SKU tier/size, admin login and password from an environment variable, PostgreSQL version 11-16, storage size/auto-grow/tier, backup retention and geo-redundancy, zone-redundant high availability, and dual auth config enabling both Entra ID and password authentication); creating a database (charset, collation); configuring firewall rules (a specific IP range, or the special AllowAllAzureServicesAndResourcesWithinAzureIps rule); reading and updating server configuration parameters (e.g. max_connections, shared_buffers, work_mem, maintenance_work_mem, effective_cache_size, log_min_duration_statement); adding an Entra ID administrator by principal name and tenant ID; listing servers and their databases; listing backups and performing point-in-time restore to a new server instance; creating a read replica in another region; stopping/starting/restarting a server (with an optional planned-failover restart for HA); scaling a server's SKU and storage via a patch update; and deleting a server. High availability modes are Disabled, SameZone, or ZoneRedundant; SKU tiers are Burstable (dev/test), GeneralPurpose (production), and MemoryOptimized (memory-heavy workloads). Error handling distinguishes 409 (server already exists) and 400 (invalid configuration) via RequestFailedException. Connection string construction is shown both ways: a plain Npgsql connection string with username/password, and the Entra ID-recommended approach of acquiring a token scoped to https://ossrdbms-aad.database.windows.net/.default via DefaultAzureCredential and using it as the password. Best practices: always use Flexible Server, enable zone-redundant HA for production, prefer DefaultAzureCredential over connection strings, enable both Entra ID and password auth for flexibility, set backup retention per compliance needs (7-35 days), use private endpoints for secure network access, tune server parameters to the actual workload, use read replicas for read-heavy traffic, and stop dev/test servers when not in use to save cost.

Use this skill when provisioning, scaling, securing, or automating the lifecycle of an Azure Database for PostgreSQL Flexible Server instance - server creation, firewall/network config, HA and backup setup, read replicas, and point-in-time restore. It is not a data-access library (use Npgsql or its EF Core provider for actual queries against the database) and does not cover the deprecated Single Server deployment model.

Input is server configuration (SKU, version, storage, HA, backup, auth settings), database/firewall/parameter definitions, or a source server and point-in-time/replica target. Output is provisioned PostgreSqlFlexibleServerResource objects and their child resources (databases, firewall rules, configurations, backups, Entra ID admin), plus server lifecycle state changes (stopped/started/restarted/scaled/deleted).

Built on Azure Resource Manager via Azure.ResourceManager.PostgreSql, authenticated with Azure Identity's DefaultAzureCredential, paired with Npgsql/Npgsql.EntityFrameworkCore.PostgreSQL for actual data access once the server is provisioned.

dotnet add package Azure.ResourceManager.PostgreSql

.NET developers and platform teams provisioning and operating Azure Database for PostgreSQL Flexible Server infrastructure - creation, scaling, HA, backup/restore, and read replicas - as distinct from the application's data-access layer, targeting a specific server via AZURE_SUBSCRIPTION_ID, AZURE_RESOURCE_GROUP, and AZURE_POSTGRESQL_SERVER_NAME.