Back to Checks
azure

MySQL flexible server enforces TLS 1.2 or higher

mysql_flexible_server_minimum_tls_version_12
Service: mysqlSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.dbformysql/flexibleservers

Azure Database for MySQL Flexible Server uses the tls_version setting to permit only modern TLS for client connections, requiring TLSv1.2+ and excluding TLSv1.0 and TLSv1.1.

Prowler logoProwlerprowler-provider-azure

Risk

Allowing legacy TLS (TLSv1.0/TLSv1.1) weakens confidentiality and integrity of data in transit. Attackers can force downgrades and perform man-in-the-middle interception, exposing credentials and queries or altering results, leading to unauthorized access and data exfiltration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks mysql_flexible_server_minimum_tls_version_12

Recommendation

Enforce a minimum TLS of TLSv1.2 (prefer TLSv1.3) and disable TLSv1.0/TLSv1.1. Ensure clients and drivers support modern TLS, deprecate weak cipher suites, and validate in staging. Apply defense in depth with private connectivity and restricted network access.

Remediation

CLI

az mysql flexible-server parameter set --resource-group <resourceGroupName> --server-name <serverName> --name tls_version --value TLSv1.2

Terraform

# Enforce TLS 1.2 on MySQL Flexible Server
resource "azurerm_mysql_flexible_server_configuration" "tls" {
  name                = "tls_version"
  resource_group_name = "<example_resource_group>"
  server_name         = "<example_server_name>"
  value               = "TLSv1.2" # Critical: sets minimum TLS to 1.2 (no 1.0/1.1)
}

NativeIaC

// Set MySQL Flexible Server to enforce TLS 1.2
resource tlsVersion 'Microsoft.DBforMySQL/flexibleServers/configurations@2022-01-01' = {
  name: '<example_resource_name>/tls_version'
  properties: {
    value: 'TLSv1.2' // Critical: enforces minimum TLS 1.2 and rejects TLS 1.0/1.1
  }
}

Other

1In Azure portal, go to Azure Database for MySQL flexible server <example_resource_name>
2Select Server parameters
3Search for tls_version
4Set the value to TLSv1.2
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.mysql.mysql_client import mysql_client


class mysql_flexible_server_minimum_tls_version_12(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            servers,
        ) in mysql_client.flexible_servers.items():
            subscription_name = mysql_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for server in servers.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
                report.subscription = subscription_id
                report.status = "FAIL"
                report.status_extended = f"TLS version is not configured in server {server.name} in subscription {subscription_name} ({subscription_id})."

                if "tls_version" in server.configurations:
                    report.resource_id = server.configurations[
                        "tls_version"
                    ].resource_id
                    report.status = "PASS"
                    report.status_extended = f"TLS version is {server.configurations['tls_version'].value} in server {server.name} in subscription {subscription_name} ({subscription_id}). This version of TLS is considered secure."

                    tls_aviable = server.configurations["tls_version"].value.split(",")

                    if "TLSv1.0" in tls_aviable or "TLSv1.1" in tls_aviable:
                        report.status = "FAIL"
                        report.status_extended = f"TLS version is {server.configurations['tls_version'].value} in server {server.name} in subscription {subscription_name} ({subscription_id}). There is at leat one version of TLS that is considered insecure."

                findings.append(report)

        return findings

References