Skip to main content

🛡️ Azure SQL Database Transparent Data Encryption is not enabled🟢

  • Contextual name: 🛡️ Database Transparent Data Encryption is not enabled🟢
  • ID: /ce/ca/azure/sql-database/database-transparent-data-encryption
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-2fcb6d852

Description​

Open File

Description​

Enable Transparent Data Encryption on every SQL Database.

Rationale​

Azure SQL Database transparent data encryption helps protect against the threat of malicious activity by performing real-time encryption and decryption of the database, associated backups, and transaction log files at rest without requiring changes to the application.

Audit​

From Azure Portal​
  1. Go to SQL databases.
  2. For each DB instance, under Security, click Data Encryption.
  3. Under Transparent data encryption, ensure that Data encryption is set to On.
From Azure CLI​

Ensure the output of the following command is Enabled:

az sql db tde show \
    --resource-group {{resource-group-name}} \
    --server {{server-name}} \
    --database {{database-name}} \
    --query status
From PowerShell​

Get a list of SQL Servers:

Get-AzSqlServer

For each server, list the databases:

Get-AzSqlDatabase `
    -ServerName {{sql-server-name}} `
    -ResourceGroupName {{resource-group-name}}

For each database not listed as a Master database, check for Transparent Data Encryption:

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Go to SQL databases.
  2. For each DB instance, under Security, click Data Encryption.
  3. Under Transparent data encryption, set Data encryption to On.
  4. Click Save.

From Azure CLI​

Use the following command to enable Transparent data encryption for a SQL database:

az sql db tde set \
    --resource-group {{resource-group-name}} \
    --server {{server-name}} \
    --database {{database-name}} \
    --status Enabled

From PowerShell​

Use the following command to enable Transparent data encryption for a SQL database:

Set-AzSqlDatabaseTransparentDataEncryption `
    -ResourceGroupName {{resource-group-name}} `
    -ServerName {{sql-server-name}} `
    -DatabaseName {{database-name}} `
    -State "Enabled"

Note:

  • TDE cannot be used to encrypt the logical master database in SQL Database. The master database contains objects that are needed to perform the TDE operations on the user databases.
  • Azure Portal does not show master databases per SQL server. However, CLI/API responses will show master databases.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS Azure v2.1.0 → 💼 4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database - Level 1 (Automated)1no data
💼 CIS Azure v3.0.0 → 💼 5.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database (Automated)1no data
💼 Cloudaware Framework → 💼 Data Encryption61no data
💼 FedRAMP High Security Controls → 💼 AC-2(1) Automated System Account Management (M)(H)26no data
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)3784no data
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)84no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(1) Automated System Account Management (M)(H)26no data
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)84no data
💼 ISO/IEC 27001:2022 → 💼 5.15 Access control1431no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(1) Account Management _ Automated System Account Management426no data
💼 SOC 2 → 💼 CC7.1-1 Uses Defined Configuration Standards45no data
💼 UK Cyber Essentials → 💼 1.2 Prevent access to the administrative interface from the internet3638no data
💼 UK Cyber Essentials → 💼 2.1.2 Change any default or guessable account passwords23no data
💼 UK Cyber Essentials → 💼 4.2.2 Use technical controls to manage the quality of passwords.23no data
💼 UK Cyber Essentials → 💼 4.2.4 The password element of the multi-factor authentication23no data