rules/findings/azure/databases/azure_sql/azure-managed-sql-lacks-data-encryption.json
|
{
"provider": "Azure", "serviceType": "SQL Database", "serviceName": "Databases", "displayName": "Ensure that \u0027Data encryption\u0027 is set to \u0027On\u0027 on a SQL Database", "description": "Enable Transparent Data Encryption on every SQL server.", "rationale": "Azure SQL Database transparent data encryption helps protect against the threat of malicious activity by performing real-time encryption and decryption of the database, associated backups, and transaction log files at rest without requiring changes to the application.", "impact": "", "remediation": { "text": "\n\t\t\t##### Remediate From Azure Portal \n\t\t\t1. Go to SQL databases \n\t\t\t2. For each DB instance \n\t\t\t3. Click on Transparent data encryption \n\t\t\t4. Set Data encryption to On Remediate From Azure CLI Use the below command to enable Transparent data encryption for SQL DB instance.\n\t\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://docs.microsoft.com/en-us/sql/relationaldatabases/security/encryption/transparent-data-encryption-with-azure-sql-", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-dataprotection#dp-4-enable-data-at-rest-encryption-by-default", "https://learn.microsoft.com/en-us/powershell/module/az.sql/setazsqldatabasetransparentdataencryption?view=azps-9.2.0" ], "compliance": [ { "name": "CIS Microsoft Azure Database Services", "version": "2.0.0", "reference": "9.6", "profile": [ "Level 1" ] } ], "level": "medium", "tags": [], "rule": { "path": "az_sql_managed_servers", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [ [ "databases.name", "ne", "master" ], [ "databases.tdeSettings.status", "ne", "Enabled" ] ], "operator": "and" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "name": "Name", "location": "location", "resourceGroupName": "Resource Group Name" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "id", "name", "location", "databases" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "name": "Name", "location": "location", "resourceGroupName": "Resource Group Name" }, "expandObject": null }, "status": { "keyName": [ "name" ], "message": "Ensure that \u0027Data encryption\u0027 is set to \u0027On\u0027 on a SQL Database for {name}", "defaultMessage": null }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "type" }, "onlyStatus": false } }, "idSuffix": "azure_managed_sql_database_data_encryption_disabled", "notes": [], "categories": [], "immutableProperties": [ "name", "id" ], "id": "azure_managed_sql_001" } |