Skip to content

MySQL server databases do not have Enforce SSL connection enabled

Description

SSL connectivity provides a new layer of security by connecting a database server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between a database server and client applications helps protect against man-in-the-middle attacks. This is achieved by encrypting the data stream between the server and application.

We recommend you set Enforce SSL connection to Enable on MYSQL Server databases.

Fix - Runtime

Azure Portal

To change the policy using the Azure Portal, follow these steps:

  1. Log in to the Azure Portal at https://portal.azure.com.
  2. Navigate to Azure Database for MySQL server.
  3. For each database:
    a) Click Connection security.
    b) Navigate to SSL Settings section.
    c) To Enforce SSL connection click ENABLED.

CLI Command

To set MYSQL Databases to Enforce SSL connection, use the following command:

az mysql server update 
--resource-group <resourceGroupName> 
--name <serverName> 
--ssl-enforcement Enabled

Fix - Buildtime

Terraform

  • Resource: azurerm_mysql_server
  • Argument: ssl_enforcement_enabled
resource "azurerm_mysql_server" "example" {
    ...
 +  ssl_enforcement_enabled             = true
}