> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Transparent Data Encryption Disabled for SQL Databases

### More Info:

Enable transparent data encryption for all SQL databases.

### Risk Level

Medium

### Address

Reliability, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AZURE
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* GDPR
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of Transparent Data Encryption Disabled for SQL Databases in Azure, you can follow the below steps using the Azure console:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Navigate to the SQL databases section of the Azure portal.
        3. Select the SQL database for which you want to enable Transparent Data Encryption.
        4. Click on the "Transparent Data Encryption" option under the "Security" section in the left-hand menu.
        5. In the "Transparent Data Encryption" blade, toggle the "Status" switch to "On".
        6. In the "Transparent Data Encryption" blade, select the "Service-managed key" option.
        7. Click on the "Save" button to enable Transparent Data Encryption for the selected SQL database.

        After completing these steps, Transparent Data Encryption will be enabled for the selected SQL database in Azure.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the Transparent Data Encryption Disabled misconfiguration for SQL databases in AZURE using AZURE CLI, follow the below steps:

        Step 1: Connect to the Azure portal using the Azure CLI.

        Step 2: Run the below command to enable Transparent Data Encryption for an existing SQL database.

        ```
        az sql db tde set --database-name <database-name> --resource-group <resource-group-name> --server <server-name> --status Enabled
        ```

        Note: Replace `<database-name>`, `<resource-group-name>`, and `<server-name>` with the actual names of the database, resource group, and server respectively.

        Step 3: Verify the status of the TDE encryption by running the below command.

        ```
        az sql db tde show --database-name <database-name> --resource-group <resource-group-name> --server <server-name>
        ```

        This command will show the current status of the TDE encryption for the specified database.

        Step 4: Repeat Steps 2 and 3 for all the SQL databases in the Azure environment to ensure that Transparent Data Encryption is enabled for all the databases.

        By following the above steps, you can remediate the Transparent Data Encryption Disabled misconfiguration for SQL databases in AZURE using AZURE CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the Transparent Data Encryption Disabled misconfiguration for SQL Databases in Azure using Python, you can use the Azure SDK for Python to enable TDE for all SQL databases in a given Azure SQL Server. Here are the step by step instructions:

        1. Install the Azure SDK for Python using pip:

        ```
        pip install azure-mgmt-sql
        ```

        2. Authenticate with Azure using your Azure account credentials:

        ```python theme={null}
        from azure.common.credentials import UserPassCredentials
        from azure.mgmt.sql import SqlManagementClient

        # Replace the placeholders with your Azure account credentials
        subscription_id = '<subscription_id>'
        username = '<username>'
        password = '<password>'

        # Create the Azure credentials object
        credentials = UserPassCredentials(username, password)

        # Create the Azure SQL Management client
        sql_client = SqlManagementClient(credentials, subscription_id)
        ```

        3. Get a list of all the SQL Servers in your Azure subscription:

        ```python theme={null}
        # Get a list of all the SQL Servers in your Azure subscription
        servers = sql_client.servers.list()

        # Print the names of all the SQL Servers
        for server in servers:
            print(server.name)
        ```

        4. For each SQL Server, get a list of all the SQL Databases and enable TDE for each database:

        ```python theme={null}
        # For each SQL Server, get a list of all the SQL Databases and enable TDE for each database
        for server in servers:
            # Get a list of all the SQL Databases in the SQL Server
            databases = sql_client.databases.list_by_server(server.resource_group, server.name)

            # For each SQL Database, enable TDE if it is not already enabled
            for database in databases:
                if not database.transparent_data_encryption.enabled:
                    # Enable TDE for the SQL Database
                    sql_client.transparent_data_encryptions.create_or_update(
                        server.resource_group,
                        server.name,
                        database.name,
                        {
                            'status': 'Enabled'
                        }
                    )
        ```

        5. Verify that TDE is now enabled for all SQL Databases:

        ```python theme={null}
        # Verify that TDE is now enabled for all SQL Databases
        for server in servers:
            # Get a list of all the SQL Databases in the SQL Server
            databases = sql_client.databases.list_by_server(server.resource_group, server.name)

            # For each SQL Database, check if TDE is enabled
            for database in databases:
                if database.transparent_data_encryption.enabled:
                    print('TDE is enabled for database {} in server {}'.format(database.name, server.name))
                else:
                    print('TDE is not enabled for database {} in server {}'.format(database.name, server.name))
        ```

        These steps will enable TDE for all SQL Databases in all SQL Servers in your Azure subscription. You can run this Python script periodically to ensure that TDE is always enabled for all SQL Databases.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_mssql_database" "SQL_DATABASE_NAME" {
          name           = "SQL_DATABASE_NAME"          # replace with your DB name
          server_id      = azurerm_mssql_server.SQL_SERVER_NAME.id
          sku_name       = "S0"                         # replace with your desired SKU
          collation      = "SQL_Latin1_General_CP1_CI_AS"

          # Enable Transparent Data Encryption (TDE)
          transparent_data_encryption_enabled = true
        }
        ```

        This change is in-place and does not force replacement of the database; Azure will enable TDE on the existing database.

        Verification: `terraform plan` should show `transparent_data_encryption_enabled` changing from `false` (or `null`/omitted) to `true` on the `azurerm_mssql_database` resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>