Back to Checks
azure

MySQL flexible server has audit_log_enabled set to ON

mysql_flexible_server_audit_log_enabled
Service: mysqlSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.dbformysql/flexibleservers

Azure Database for MySQL Flexible Server with audit_log_enabled set to ON generates audit logs for connections, authentication, DDL/DML, and administrative actions.

Prowler logoProwlerprowler-provider-azure

Risk

Missing audit logs reduces accountability and obscures activity affecting confidentiality and integrity. Unauthorized logins, privilege abuse, or suspicious queries may go undetected, impeding forensics, slowing incident response, and enabling covert data exfiltration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks mysql_flexible_server_audit_log_enabled

Recommendation

Enable audit logging (audit_log_enabled=ON) and select events that matter. Export MySqlAuditLogs to a centralized store, enforce least privilege on log access, set retention, and create alerts for anomalies. Regularly review logs as part of defense in depth.

Remediation

CLI

az mysql flexible-server parameter set --name audit_log_enabled --resource-group <RESOURCE_GROUP> --server-name <SERVER_NAME> --value ON

Terraform

# Enable audit logs on MySQL Flexible Server
resource "azurerm_mysql_flexible_server_configuration" "<example_resource_name>" {
  name                = "audit_log_enabled"
  resource_group_name = "<example_resource_name>"
  server_name         = "<example_resource_name>"
  value               = "ON" # CRITICAL: enables audit logging to pass the check
}

NativeIaC

// Enable audit logs on an existing MySQL Flexible Server
resource server 'Microsoft.DBforMySQL/flexibleServers@2021-12-01-preview' existing = {
  name: '<example_resource_name>'
}

resource audit 'Microsoft.DBforMySQL/flexibleServers/configurations@2021-12-01-preview' = {
  name: 'audit_log_enabled'
  parent: server
  properties: {
    value: 'ON' // CRITICAL: turns audit_log_enabled ON to pass the check
  }
}

Other

1Sign in to the Azure portal
2Go to: Azure Database for MySQL flexible server > Your server
3Under Settings, select Server parameters
4Find audit_log_enabled and set it to ON
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.mysql.mysql_client import mysql_client


class mysql_flexible_server_audit_log_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            servers,
        ) in mysql_client.flexible_servers.items():
            subscription_name = mysql_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for server in servers.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
                report.status = "FAIL"
                report.subscription = subscription_id
                report.status_extended = f"Audit log is disabled for server {server.name} in subscription {subscription_name} ({subscription_id})."

                if "audit_log_enabled" in server.configurations:
                    report.resource_id = server.configurations[
                        "audit_log_enabled"
                    ].resource_id

                    if server.configurations["audit_log_enabled"].value.lower() == "on":
                        report.status = "PASS"
                        report.status_extended = f"Audit log is enabled for server {server.name} in subscription {subscription_name} ({subscription_id})."

                findings.append(report)

        return findings

References