Encrypted connections

March 21, 2025 ยท View on GitHub

SYNOPSIS

Azure Database for MariaDB servers should only accept encrypted connections.

DESCRIPTION

Azure Database for MariaDB is configured to only accept encrypted connections by default. When the setting enforce SSL connections is disabled, encrypted and unencrypted connections are permitted. This does not indicate that unencrypted connections are being used.

Unencrypted communication to MariaDB server instances could allow disclosure of information to an untrusted party.

RECOMMENDATION

Azure Database for MariaDB should be configured to only accept encrypted connections. Unless explicitly required, consider enabling enforce SSL connections.

Also consider using Azure Policy to audit or enforce this configuration.

EXAMPLES

Configure with Azure template

To deploy Azure Database for MariaDB Servers that pass this rule:

  • Set the properties.sslEnforcement property to Enabled.

For example:

{
  "type": "Microsoft.DBforMariaDB/servers",
  "apiVersion": "2018-06-01",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "sku": {
    "name": "[parameters('sku')]",
    "tier": "GeneralPurpose",
    "capacity": "[parameters('skuCapacity')]",
    "size": "[format('{0}', parameters('skuSizeMB'))]",
    "family": "Gen5"
  },
  "properties": {
    "sslEnforcement": "Enabled",
    "minimalTlsVersion": "TLS1_2",
    "createMode": "Default",
    "version": "10.3",
    "administratorLogin": "[parameters('administratorLogin')]",
    "administratorLoginPassword": "[parameters('administratorLoginPassword')]",
    "publicNetworkAccess": "Disabled",
    "storageProfile": {
      "storageMB": "[parameters('skuSizeMB')]",
      "backupRetentionDays": 7,
      "geoRedundantBackup": "Enabled"
    }
  }
}

Configure with Bicep

To deploy Azure Database for MariaDB Servers that pass this rule:

  • Set the properties.sslEnforcement property to Enabled.

For example:

resource server 'Microsoft.DBforMariaDB/servers@2018-06-01' = {
  name: name
  location: location
  sku: {
    name: sku
    tier: 'GeneralPurpose'
    capacity: skuCapacity
    size: '${skuSizeMB}'
    family: 'Gen5'
  }
  properties: {
    sslEnforcement: 'Enabled'
    minimalTlsVersion: 'TLS1_2'
    createMode: 'Default'
    version: '10.3'
    administratorLogin: administratorLogin
    administratorLoginPassword: administratorLoginPassword
    publicNetworkAccess: 'Disabled'
    storageProfile: {
      storageMB: skuSizeMB
      backupRetentionDays: 7
      geoRedundantBackup: 'Enabled'
    }
  }
}