Description:

This check verifies that Enforce SSL Connection is enabled for Azure Database for MySQL. When enabled, all client connections to the MySQL server must use SSL/TLS encryption, ensuring that data transmitted between clients and the database server is protected from interception and tampering.


Rationale:

Without SSL enforcement, clients may connect to the database using unencrypted connections, exposing sensitive data such as credentials and application data to potential interception. Enabling SSL enforcement ensures secure communication channels and helps meet security and compliance requirements.


Impact:

  • Protects data in transit through encryption.

  • Prevents unauthorized interception of sensitive information.

  • Supports compliance with security standards and regulatory requirements.

  • Legacy applications that do not support SSL/TLS may require configuration updates before connecting.


Default Value:

SSL support is enabled by default; however, Enforce SSL Connection should be verified to ensure that all client connections are required to use SSL/TLS.


Prerequisites:

  • Appropriate Azure permissions (Reader for validation, Contributor/Owner for remediation) to access and manage the Azure Database for MySQL server.

  • The target MySQL server has been identified and change approval has been obtained before performing remediation activities.


Remediation:

Test Plan:

Using Azure Portal

  1. Sign in to the Azure Portal.

  2. Navigate to Azure Database for MySQL.

  3. Select the MySQL server.

  4. Under Settings, select Connection Security (or Networking, depending on the deployment model).

  5. Review the Enforce SSL Connection setting.

  6. Verify that the setting is configured as Enabled.


Implementation:

Using Azure Portal

  1. Sign in to the Azure Portal.

  2. Navigate to Azure Database for MySQL.

  3. Select the affected MySQL server.

  4. Under Settings, select Connection Security.

  5. Locate Enforce SSL Connection.

  6. Set the value to Enabled.

  7. Click Save.

  8. Verify that applications can successfully connect using SSL/TLS.


Backout Plan:

  1. Navigate to the affected MySQL server.

  2. Open Connection Security settings.

  3. Restore the previous SSL enforcement setting if application connectivity issues occur.

  4. Save the configuration.

  5. Validate application connectivity.

  6. Update or reconfigure affected clients to support SSL/TLS before re-enabling enforcement.

Note: Disabling SSL enforcement should only be considered a temporary measure while resolving application compatibility issues.


References: