Back to Checks
azure

MySQL Flexible Server enforces SSL connections

mysql_flexible_server_ssl_connection_enabled
Service: mysqlSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.dbformysql/flexibleservers

Azure Database for MySQL Flexible Server uses the require_secure_transport parameter to enforce encrypted connections. This evaluation determines whether the server is configured to require TLS/SSL for all client sessions.

Prowler logoProwlerprowler-provider-azure

Risk

Without TLS enforcement, credentials and queries may traverse the network in cleartext, enabling man-in-the-middle, credential theft, tampering, and data exfiltration. This directly impacts confidentiality and integrity and can lead to compliance violations.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks mysql_flexible_server_ssl_connection_enabled

Recommendation

Set require_secure_transport=ON and permit only TLS 1.2+. Ensure clients validate certificates and use FQDNs. Combine with private access (Private Link or VNet), restrictive firewall rules, and least privilege to reduce exposure. Avoid legacy TLS or plaintext connections.

Remediation

CLI

az mysql flexible-server parameter set --resource-group <RESOURCE_GROUP> --server-name <SERVER_NAME> --name require_secure_transport --value ON

Terraform

# Enforce SSL/TLS on MySQL Flexible Server
resource "azurerm_mysql_flexible_server_configuration" "secure" {
  name                = "require_secure_transport"
  resource_group_name = "<example_resource_group>"
  server_name         = "<example_server_name>"
  value               = "ON" # Critical: enables SSL enforcement
}

NativeIaC

// Enforce SSL/TLS by enabling require_secure_transport on MySQL Flexible Server
resource reqSecureTransport 'Microsoft.DBforMySQL/flexibleServers/configurations@2023-12-30' = {
  name: '<example_resource_name>/require_secure_transport'
  properties: {
    value: 'ON' // Critical: turns on SSL enforcement (require_secure_transport)
  }
}

Other

1Sign in to the Azure portal
2Go to: Azure Database for MySQL Flexible Server > <your server>
3Select Server parameters
4Find require_secure_transport and set it to ON
5Click Save
6Verify by refreshing Server parameters and confirming the value is ON

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.mysql.mysql_client import mysql_client


class mysql_flexible_server_ssl_connection_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            servers,
        ) in mysql_client.flexible_servers.items():
            subscription_name = mysql_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for server in servers.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
                report.subscription = subscription_id
                report.status = "FAIL"
                report.status_extended = f"SSL connection is disabled for server {server.name} in subscription {subscription_name} ({subscription_id})."

                if "require_secure_transport" in server.configurations:
                    report.resource_id = server.configurations[
                        "require_secure_transport"
                    ].resource_id
                    if (
                        server.configurations["require_secure_transport"].value.lower()
                        == "on"
                    ):
                        report.status = "PASS"
                        report.status_extended = f"SSL connection is enabled for server {server.name} in subscription {subscription_name} ({subscription_id})."

                findings.append(report)

        return findings

References