Skip to main content

🛡️ Azure MySQL Flexible Server TLS Version is not set to TLS 1.2🟢

  • Contextual name: 🛡️ Flexible Server TLS Version is not set to TLS 1.2🟢
  • ID: /ce/ca/azure/mysql-database/flexible-server-latest-tls-version
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-aeac09d61

Description​

Open File

Description​

Ensure tls_version on MySQL flexible servers is set to use TLS version 1.2 or higher.

Rationale​

TLS connectivity helps to provide a new layer of security by connecting database server to client applications using Transport Layer Security (TLS). Enforcing TLS connections between database server and client applications helps protect against "man in the middle" attacks by encrypting the data stream between the server and application.

Audit​

From Azure Portal​
  1. Login to Azure Portal using https://portal.azure.com.
  2. Go to Azure Database for MySQL flexible servers.
  3. For each database, under Settings, click Server parameters.
  4. In the filter bar, type tls_version.
  5. Ensure tls_version is set to TLSv1.2 (or higher).
From Azure CLI​

Ensure the Value of the below command contains TLSv1.2 or higher, and does not contain anything lower than TLSv1.2:

az mysql flexible-server parameter show --resource-group <resourceGroup> --server-name <serverName> --name tls_version

Example output:

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Login to Azure Portal using https://portal.azure.com.
  2. Go to Azure Database for MySQL flexible servers.
  3. For each database, under Settings, click Server parameters.
  4. In the filter bar, type tls_version.
  5. Click on the VALUE dropdown next to tls_version, and check TLSv1.2 (or higher).
  6. Uncheck anything lower than TLSv1.2.
  7. Click Save.

From Azure CLI​

Use the below command to update MySQL flexible servers to use TLS version 1.2:

az mysql flexible-server parameter set --resource-group <resourceGroup> --server-name <serverName> --name tls_version --value TLSv1.2

From PowerShell​

Use the below command to update MySQL flexible servers to use TLS version 1.2:

Update-AzMySqlFlexibleServerConfiguration -ResourceGroupName <resourceGroup> -ServerName <serverName> -Name tls_version -Value TLSv1.2

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 54 Cryptographic techniques can be used to control access to sensitive data, both in storage and in transit. The strength of the cryptographic techniques deployed would be commensurate with the sensitivity and criticality of the data as well as other supplementary or compensating controls (refer to Attachment E for further guidance).2122no data
💼 CIS Azure v1.4.0 → 💼 4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server - Level 1 (Automated)11no data
💼 CIS Azure v1.5.0 → 💼 4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server - Level 1 (Automated)11no data
💼 CIS Azure v2.0.0 → 💼 4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server - Level 1 (Automated)11no data
💼 CIS Azure v2.1.0 → 💼 4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' (or higher) for MySQL flexible Database Server - Level 1 (Automated)1no data
💼 CIS Azure v3.0.0 → 💼 5.3.2 Ensure server parameter 'tls_version' is set to 'TLSv1.2' (or higher) for MySQL flexible server (Automated)1no data
💼 Cloudaware Framework → 💼 Data Encryption44no data
💼 FedRAMP High Security Controls → 💼 AC-4(4) Flow Control of Encrypted Information (H)2526no data
💼 FedRAMP High Security Controls → 💼 AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H)17no data
💼 FedRAMP High Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)816no data
💼 FedRAMP Low Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)16no data
💼 FedRAMP Moderate Security Controls → 💼 AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H)17no data
💼 FedRAMP Moderate Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)16no data
💼 ISO/IEC 27001:2022 → 💼 5.14 Information transfer810no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains3032no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-17(2) Remote Access _ Protection of Confidentiality and Integrity Using Encryption1217no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8(1) Transmission Confidentiality and Integrity _ Cryptographic Protection815no data