> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# MySQL Database Server Should Enforce SSL Connection

### More Info:

MySQL Database Server should have enforce ssl connection enabled

### Risk Level

Medium

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AZURE
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions to remediate the MySQL Database Server Should Enforce SSL Connection misconfiguration in Azure using the Azure console:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).

        2. Navigate to the Azure Database for MySQL server that you want to remediate.

        3. Click on the "Connection security" option under the "Security" section in the left-hand menu.

        4. In the "Connection security" section, toggle the "Enforce SSL connection" option to "Enabled".

        5. Click the "Save" button at the top of the page to save the changes.

        6. Once the changes are saved, the MySQL database server will now enforce SSL connections.

        That's it! By following these steps, you have successfully remediated the MySQL Database Server Should Enforce SSL Connection misconfiguration in Azure using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the MySQL Database Server Should Enforce SSL Connection misconfiguration in Azure using Azure CLI, you can follow the below steps:

        1. Open the Azure CLI and log in to your Azure account using the command `az login`.

        2. Once you are logged in, select the Azure subscription that contains your MySQL database by using the command `az account set --subscription <subscription_id>`.

        3. Next, retrieve the resource ID of your MySQL server using the command `az mysql server list --resource-group <resource_group_name> --query [0].id --output tsv`.

        4. Now, enable SSL enforcement for the MySQL server by running the command `az mysql server update --resource-group <resource_group_name> --name <mysql_server_name> --ssl-enforcement Enabled`.

        5. Finally, verify that SSL enforcement is enabled by running the command `az mysql server show --resource-group <resource_group_name> --name <mysql_server_name> --query sslEnforcement`.

        If the output of the above command is "Enabled", then SSL enforcement has been successfully enabled for your MySQL server in Azure.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of MySQL Database Server Should Enforce SSL Connection in AZURE, you can follow the below steps using Python:

        1. First, you need to install the 'azure-mgmt-rdbms' package. You can install it using the following command:

        ```
        pip install azure-mgmt-rdbms
        ```

        2. Next, you need to authenticate to your Azure account. You can use the following code to authenticate:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials

        # Replace the values with your own
        subscription_id = 'your_subscription_id'
        client_id = 'your_client_id'
        secret = 'your_client_secret'
        tenant = 'your_tenant_id'

        credentials = ServicePrincipalCredentials(
            client_id=client_id,
            secret=secret,
            tenant=tenant
        )
        ```

        3. After authentication, you need to create a client object for the Azure Database for MySQL server. You can use the following code to create the client object:

        ```python theme={null}
        from azure.mgmt.rdbms.mysql import MySQLManagementClient
        from azure.mgmt.rdbms.mysql.models import ServerForUpdate

        # Replace the values with your own
        resource_group_name = 'your_resource_group_name'
        server_name = 'your_server_name'
        location = 'your_server_location'

        client = MySQLManagementClient(
            credentials=credentials,
            subscription_id=subscription_id
        )

        server = client.servers.get(resource_group_name, server_name)
        ```

        4. Once you have the client object, you can update the server configuration to enforce SSL connection. You can use the following code to update the server configuration:

        ```python theme={null}
        server.ssl_enforcement = 'Enabled'

        server_for_update = ServerForUpdate(
            ssl_enforcement=server.ssl_enforcement
        )

        client.servers.begin_create_or_update(
            resource_group_name=resource_group_name,
            server_name=server_name,
            parameters=server_for_update
        )
        ```

        5. Finally, you can verify if the SSL connection is enforced by checking the server configuration. You can use the following code to check the server configuration:

        ```python theme={null}
        server = client.servers.get(resource_group_name, server_name)

        if server.ssl_enforcement == 'Enabled':
            print('SSL connection is enforced')
        else:
            print('SSL connection is not enforced')
        ```

        That's it! You have successfully remediated the misconfiguration of MySQL Database Server Should Enforce SSL Connection in Azure using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_mysql_server" "MYSQL_SERVER" {
          name                = "MYSQL_SERVER_NAME"            # substitute your MySQL server name
          location            = "AZURE_LOCATION"               # e.g. westus2
          resource_group_name = "RESOURCE_GROUP_NAME"

          administrator_login          = "ADMIN_USERNAME"
          administrator_login_password = "ADMIN_PASSWORD"

          sku_name   = "MYSQL_SKU_NAME"                        # e.g. GP_Gen5_2
          storage_mb = 51200
          version    = "5.7"

          # Enforce SSL connections (remediates the finding)
          ssl_enforcement_enabled = true

          # (optional but recommended) enforce minimum TLS version
          # ssl_minimal_tls_version_enforced = "TLS1_2"

          backup_retention_days            = 7
          geo_redundant_backup_enabled     = false
          auto_grow_enabled                = true
          public_network_access_enabled    = true
          infrastructure_encryption_enabled = false

          tags = {
            Environment = "ENVIRONMENT_TAG"
          }
        }
        ```

        Changing `ssl_enforcement_enabled` from `false` to `true` is an in-place update and does not force replacement of the server.

        To verify, `terraform plan` should show a single in-place change on this resource, with `ssl_enforcement_enabled` changing from `false` (or `null`) to `true`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>