Back to Checks
azure

MySQL flexible server has geo-redundant backup enabled

mysql_flexible_server_geo_redundant_backup_enabled
Service: mysqlSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:microsoft.dbformysql/flexibleservers

Azure MySQL Flexible Server is evaluated for geo-redundant backup. Geo-redundant backup stores backup copies in a paired Azure region, enabling restore and recovery from a full regional outage.

Prowler logoProwlerprowler-provider-azure

Risk

Without geo-redundant backup, a regional disaster can cause permanent data loss. Locally redundant backups only protect against storage hardware failures within the same region and cannot be restored if the primary region becomes unavailable.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks mysql_flexible_server_geo_redundant_backup_enabled

Recommendation

Enable geo-redundant backup on MySQL Flexible Servers so backups are replicated to the paired Azure region and can be restored during a regional outage. Because this is set at server creation, plan a migration for existing servers, and pair it with an appropriate backup retention period and periodic restore testing.

Remediation

CLI

az mysql flexible-server create --name <server_name> --resource-group <resource_group_name> --location <region> --geo-redundant-backup Enabled

Terraform

# Terraform: MySQL Flexible Server with geo-redundant backup (set at creation)
resource "azurerm_mysql_flexible_server" "<example_resource_name>" {
  name                         = "<example_resource_name>"
  resource_group_name          = "<example_resource_name>"
  location                     = "<region>"
  geo_redundant_backup_enabled = true # CRITICAL: stores backups in the paired region
}

NativeIaC

// Bicep: MySQL Flexible Server with geo-redundant backup (set at creation)
resource mysql 'Microsoft.DBforMySQL/flexibleServers@2023-12-30' = {
  name: '<example_resource_name>'
  location: '<region>'
  properties: {
    backup: {
      geoRedundantBackup: 'Enabled' // CRITICAL: stores backups in the paired region
    }
  }
}

Other

1Geo-redundant backup must be configured when the server is created; it cannot be enabled on an existing server
2In the Azure portal, start creating a new Azure Database for MySQL flexible server
3On the Basics tab, under Compute + storage, open Configure server
4Set Geographically redundant backup to Enabled and save
5Finish creating the server and migrate workloads to it

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.mysql.mysql_client import mysql_client


class mysql_flexible_server_geo_redundant_backup_enabled(Check):
    """
    Ensure Azure MySQL Flexible Servers have geo-redundant backup enabled.

    This check evaluates whether each Azure MySQL Flexible Server stores backups in a paired Azure region, enabling recovery from a full regional outage.

    - PASS: The server has geo-redundant backup enabled (geo_redundant_backup is "Enabled").
    - FAIL: The server does not have geo-redundant backup enabled.
    """

    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription_id, servers in mysql_client.flexible_servers.items():
            subscription_name = mysql_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for server in servers.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
                report.subscription = subscription_id
                if server.geo_redundant_backup == "Enabled":
                    report.status = "PASS"
                    report.status_extended = f"Geo-redundant backup is enabled for server {server.name} in subscription {subscription_name} ({subscription_id})."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Geo-redundant backup is disabled for server {server.name} in subscription {subscription_name} ({subscription_id})."
                findings.append(report)
        return findings

References