Back to Checks
azure

MySQL flexible server has audit_log_events including CONNECTION

mysql_flexible_server_audit_log_connection_activated
Service: mysqlSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.dbformysql/flexibleservers

Azure Database for MySQL Flexible Server audit configuration includes the CONNECTION event in audit_log_events.

Prowler logoProwlerprowler-provider-azure

Risk

Without CONNECTION auditing, login attempts are invisible, weakening detection of brute-force, credential stuffing, and anomalous access. This enables unnoticed account takeover and lateral movement, impacting confidentiality and integrity, and hinders forensics and timely response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks mysql_flexible_server_audit_log_connection_activated

Recommendation

Include CONNECTION in audit_log_events to capture login activity. Centralize and retain audit logs, restrict access by least privilege, and protect logs from tampering. Monitor for anomalous sign-in patterns and alert. Pair with defense-in-depth controls (MFA, network allow-listing) to reduce exposure.

Remediation

CLI

az mysql flexible-server parameter set --resource-group <RESOURCE_GROUP> --server-name <SERVER_NAME> --name audit_log_events --value CONNECTION

Terraform

resource "azurerm_mysql_flexible_server_configuration" "<example_resource_name>" {
  name                = "audit_log_events"
  resource_group_name = "<example_resource_group>"
  server_name         = "<example_server_name>"
  value               = "CONNECTION" # Critical: includes CONNECTION in audit logs to pass the check
}

NativeIaC

// Set MySQL Flexible Server audit_log_events to include CONNECTION
resource cfg 'Microsoft.DBforMySQL/flexibleServers/configurations@2021-05-01' = {
  name: '<example_resource_name>/audit_log_events'
  properties: {
    value: 'CONNECTION' // Critical: ensures 'CONNECTION' is logged, making the check PASS
  }
}

Other

1In the Azure Portal, go to Azure Database for MySQL flexible server
2Select your server, then go to Server parameters
3Search for audit_log_events
4Set its value to CONNECTION
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.mysql.mysql_client import mysql_client


class mysql_flexible_server_audit_log_connection_activated(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            servers,
        ) in mysql_client.flexible_servers.items():
            subscription_name = mysql_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for server in servers.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
                report.subscription = subscription_id
                report.status = "FAIL"
                report.status_extended = f"Audit log is disabled for server {server.name} in subscription {subscription_name} ({subscription_id})."

                if "audit_log_events" in server.configurations:
                    report.resource_id = server.configurations[
                        "audit_log_events"
                    ].resource_id

                    if "connection" in server.configurations[
                        "audit_log_events"
                    ].value.lower().split(","):
                        report.status = "PASS"
                        report.status_extended = f"Audit log is enabled for server {server.name} in subscription {subscription_name} ({subscription_id})."

                findings.append(report)

        return findings

References