Control: 5.3.1 Ensure server parameter 'require_secure_transport' is set to 'ON' for MySQL flexible server

Description

Enable require_secure_transport on MySQL flexible servers.

SSL connectivity helps to provide a new layer of security by connecting database server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between database server and client applications helps protect against "man in the middle" attacks by encrypting the data stream between the server and application.

Remediation

From Azure Portal

Login to Azure Portal using https://portal.azure.com.
Go to Azure Database for MySQL flexible servers.
For each database, under Settings, click Server parameters.
In the filter bar, type require_secure_transport.
Set the VALUE for require_secure_transport to ON.
Click Save.

From Azure CLI

Use the below command to enable require_secure_transport:

az mysql flexible-server parameter set --resource-group <resourceGroup> --server-name <serverName> --name require_secure_transport --value on

From PowerShell

Use the below command to enable require_secure_transport:

Update-AzMySqlFlexibleServerConfiguration -ResourceGroupName <resourceGroup> -ServerName <serverName> -Name require_secure_transport -Value on

Default Value

Azure Database for MySQL when provisioned through the Azure portal or CLI will require SSL connections by default.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v300_5_3_1

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v300_5_3_1 --share

SQL

This control uses a named query:

mysql_flexible_server_ssl_enabled