Checks

Purge protection is an optional Key Vault behavior and is not enabled by default.

Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI or PowerShell.

Expiration Date is an optional Key Vault Secret behavior and is not set by default.

Set when the resource will be become inactive.

SQL Server sends alerts for threat detection via email, if there are no email addresses set then mitigation will be delayed.

Postgresql can generate logs for successful connections to improve visibility for audit and configuration issue resolution.

SSL connections should be enforced were available to ensure secure transfer and reduce the risk of compromising data in flight.

Postgresql can generate logs for connection throttling to improve visibility for audit and configuration issue resolution.

Database resources should not publicly available. You should limit all access to the minimum that is required for your application to function.

Subscription owners should be notified when there are security alerts. By ensuring the administrators of the account have been notified they can quickly assist in any required remediation

Postgresql can generate logs for checkpoints to improve visibility for audit and configuration issue resolution.

When Auditing is configured for a SQL database, if the retention period is not set, the retention will be unlimited.

If the retention period is to be explicitly set, it should be set for no less than 90 days.

You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.

Auditing helps you maintain regulatory compliance, understand database activity, and gain insight into discrepancies and anomalies that could indicate business concerns or suspected security violations.

SQL Server can alert for security issues including SQL Injection, vulnerabilities, access anomalies and data exfiltration. Ensure none of these are disabled to benefit from the best protection

Azure services can be allowed access through the firewall using a start and end IP address of 0.0.0.0. No other end ip address should be combined with a start of 0.0.0.0

The permissions granted to a role should be kept to the minimum required to be able to do the task. Wildcard permissions must not be used.

The average time to detect a breach is up to 210 days, to ensure that all the information required for an effective investigation is available, the retention period should allow for delayed starts to investigating.

Log profiles should capture all regions to ensure that all events are logged

Log profiles should capture all categories to ensure that all events are logged

Synapse Workspace does not have managed virtual network enabled by default.

When you create your Azure Synapse workspace, you can choose to associate it to a Microsoft Azure Virtual Network. The Virtual Network associated with your workspace is managed by Azure Synapse. This Virtual Network is called a Managed workspace Virtual Network.

Managed private endpoints are private endpoints created in a Managed Virtual Network associated with your Azure Synapse workspace. Managed private endpoints establish a private link to Azure resources. You can only use private links in a workspace that has a Managed workspace Virtual Network.

Data Factory has public access set to true by default.

Disabling public network access is applicable only to the self-hosted integration runtime, not to Azure Integration Runtime and SQL Server Integration Services (SSIS) Integration Runtime.

Datalake storage encryption defaults to Enabled, it shouldn't be overridden to Disabled.

When creating Azure Virtual Machines, custom_data is used to pass start up information into the EC2 instance. This custom_dat must not contain access key credentials.

Manage disks should be encrypted at rest. When specifying the <code>encryption_settings</code> block, the enabled attribute should be set to <code>true</code>.

Access to virtual machines should be authenticated using SSH keys. Removing the option of password authentication enforces more secure methods while removing the risks inherent with passwords.