Control: 4.4.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server

Description

It is recommended to enable SSL connection on MYSQL Servers. SSL connectivity helps to provide a new layer of security, by connecting database server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between database server and client applications helps protect against attacks by encrypting the data stream between the server and application.

Remediation

From Console

Login to Azure console and navigate to PostgreSQL Servers.
For each database, go to Settings section from left pane.
Click on Connection security and go to SSL settings.
For Enforce SSL connection, click on ENABLED.

From Command Line

Enable enforce ssl connection for PostgreSQL Database

az mysql server show --resource-group myresourcegroup --name <resourceGroupName> --query sslEnforcement

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v140_4_4_1

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v140_4_4_1 --share

SQL

This control uses a named query:

select
  s.id as resource,
  case
    when ssl_enforcement = 'Disabled' then 'alarm'
    else 'ok'
  end as status,
  case
    when ssl_enforcement = 'Disabled' then s.name || ' SSL connection disabled.'
    else s.name || ' SSL connection enabled.'
  end as reason
  
  , s.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_mysql_server as s,
  azure_subscription as sub
where
  sub.subscription_id = s.subscription_id;