Update az_mssql.tf

[tsmithv11]

No description provided.

[bridgecrew]

Bridgecrew has found infrastructure configuration errors in this PR ⬇️

[bridgecrew]

  Ensure SQL server disables public network access
    Resource: azurerm_mssql_server.mssql5 | ID: BC_AZR_NETWORKING_34

How to Fix

resource "azurerm_mssql_server" "example" {
              ...
 +            public_network_access_enabled = false
            }

Description

TBA

[bridgecrew]

  Ensure Azure resources that support tags have tags
    Resource: azurerm_mssql_server.mssql1 | ID: BC_AZR_GENERAL_81

How to Fix

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_managed_disk" "example" {
  name                 = "acctestmd"
  location             = "West US 2"
  resource_group_name  = azurerm_resource_group.example.name
  storage_account_type = "Standard_LRS"
  create_option        = "Empty"
  disk_size_gb         = "1"

+  tags = {
+    environment = "staging"
  }
}

Description

Many different types of Azure resources support tags. Tags allow you to add metadata to a resource to help identify ownership, perform cost / billing analysis, and to enrich a resource with other valuable information, such as descriptions and environment names. While there are many ways that tags can be used, we recommend you follow a tagging practice.

View Microsoft's recommended tagging best practices here.

[bridgecrew]

  Ensure SQL server disables public network access
    Resource: azurerm_mssql_server.mssql1 | ID: BC_AZR_NETWORKING_34

How to Fix

resource "azurerm_mssql_server" "example" {
              ...
 +            public_network_access_enabled = false
            }

Description

TBA

[bridgecrew]

  Ensure Azure SQL Server audit log retention is greater than 90 days
    Resource: azurerm_mssql_server.mssql5 | ID: BC_AZR_LOGGING_3

How to Fix

resource "azurerm_sql_server" "example" {
    ...
    extended_auditing_policy {
      storage_endpoint            = azurerm_storage_account.example.primary_blob_endpoint
      storage_account_access_key  = azurerm_storage_account.example.primary_access_key
      storage_account_access_key_is_secondary = true
 +       retention_in_days                       = <90 or greater>
    }
}

Description

Audit Logs can be used to check for anomalies and give insight into suspected breaches or misuse of information and access.

We recommend you configure SQL server audit retention to be greater than 90 days.

Benchmarks

• CIS AZURE V1.1 4.3
• CIS AZURE V1.3 4.1.3

[bridgecrew]

  Ensure MSSQL is using the latest version of TLS encryption
    Resource: azurerm_mssql_server.mssql1 | ID: BC_AZR_GENERAL_76

How to Fix

 resource "azurerm_mssql_server" "examplea" {
   ...
 + minimum_tls_version           = "1.2"
   ...
 }

Description

The Transport Layer Security (TLS) protocol secures transmission of data between servers and web browsers, over the Internet, using standard encryption technology. To follow security best practices and the latest PCI compliance standards, enable the latest version of TLS protocol (i.e. TLS 1.2) for all your MSSQL servers.

[bridgecrew]

  Ensure Azure resources that support tags have tags
    Resource: azurerm_mssql_server.mssql5 | ID: BC_AZR_GENERAL_81

How to Fix

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_managed_disk" "example" {
  name                 = "acctestmd"
  location             = "West US 2"
  resource_group_name  = azurerm_resource_group.example.name
  storage_account_type = "Standard_LRS"
  create_option        = "Empty"
  disk_size_gb         = "1"

+  tags = {
+    environment = "staging"
  }
}

Description

Many different types of Azure resources support tags. Tags allow you to add metadata to a resource to help identify ownership, perform cost / billing analysis, and to enrich a resource with other valuable information, such as descriptions and environment names. While there are many ways that tags can be used, we recommend you follow a tagging practice.

View Microsoft's recommended tagging best practices here.

[bridgecrew]

  Ensure MSSQL is using the latest version of TLS encryption
    Resource: azurerm_mssql_server.mssql5 | ID: BC_AZR_GENERAL_76

How to Fix

 resource "azurerm_mssql_server" "examplea" {
   ...
 + minimum_tls_version           = "1.2"
   ...
 }

Description

The Transport Layer Security (TLS) protocol secures transmission of data between servers and web browsers, over the Internet, using standard encryption technology. To follow security best practices and the latest PCI compliance standards, enable the latest version of TLS protocol (i.e. TLS 1.2) for all your MSSQL servers.