> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit sqldatabase transparent data encryption disabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of Transparent Data Encryption Disabled for SQL Databases in Azure, you can follow the below steps using the Azure console:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Navigate to the SQL databases section of the Azure portal.
        3. Select the SQL database for which you want to enable Transparent Data Encryption.
        4. Click on the "Transparent Data Encryption" option under the "Security" section in the left-hand menu.
        5. In the "Transparent Data Encryption" blade, toggle the "Status" switch to "On".
        6. In the "Transparent Data Encryption" blade, select the "Service-managed key" option.
        7. Click on the "Save" button to enable Transparent Data Encryption for the selected SQL database.

        After completing these steps, Transparent Data Encryption will be enabled for the selected SQL database in Azure.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the Transparent Data Encryption Disabled misconfiguration for SQL databases in AZURE using AZURE CLI, follow the below steps:

        Step 1: Connect to the Azure portal using the Azure CLI.

        Step 2: Run the below command to enable Transparent Data Encryption for an existing SQL database.

        ```
        az sql db tde set --database-name <database-name> --resource-group <resource-group-name> --server <server-name> --status Enabled
        ```

        Note: Replace `<database-name>`, `<resource-group-name>`, and `<server-name>` with the actual names of the database, resource group, and server respectively.

        Step 3: Verify the status of the TDE encryption by running the below command.

        ```
        az sql db tde show --database-name <database-name> --resource-group <resource-group-name> --server <server-name>
        ```

        This command will show the current status of the TDE encryption for the specified database.

        Step 4: Repeat Steps 2 and 3 for all the SQL databases in the Azure environment to ensure that Transparent Data Encryption is enabled for all the databases.

        By following the above steps, you can remediate the Transparent Data Encryption Disabled misconfiguration for SQL databases in AZURE using AZURE CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the Transparent Data Encryption Disabled misconfiguration for SQL Databases in Azure using Python, you can use the Azure SDK for Python to enable TDE for all SQL databases in a given Azure SQL Server. Here are the step by step instructions:

        1. Install the Azure SDK for Python using pip:

        ```
        pip install azure-mgmt-sql
        ```

        2. Authenticate with Azure using your Azure account credentials:

        ```python theme={null}
        from azure.common.credentials import UserPassCredentials
        from azure.mgmt.sql import SqlManagementClient

        # Replace the placeholders with your Azure account credentials
        subscription_id = '<subscription_id>'
        username = '<username>'
        password = '<password>'

        # Create the Azure credentials object
        credentials = UserPassCredentials(username, password)

        # Create the Azure SQL Management client
        sql_client = SqlManagementClient(credentials, subscription_id)
        ```

        3. Get a list of all the SQL Servers in your Azure subscription:

        ```python theme={null}
        # Get a list of all the SQL Servers in your Azure subscription
        servers = sql_client.servers.list()

        # Print the names of all the SQL Servers
        for server in servers:
            print(server.name)
        ```

        4. For each SQL Server, get a list of all the SQL Databases and enable TDE for each database:

        ```python theme={null}
        # For each SQL Server, get a list of all the SQL Databases and enable TDE for each database
        for server in servers:
            # Get a list of all the SQL Databases in the SQL Server
            databases = sql_client.databases.list_by_server(server.resource_group, server.name)

            # For each SQL Database, enable TDE if it is not already enabled
            for database in databases:
                if not database.transparent_data_encryption.enabled:
                    # Enable TDE for the SQL Database
                    sql_client.transparent_data_encryptions.create_or_update(
                        server.resource_group,
                        server.name,
                        database.name,
                        {
                            'status': 'Enabled'
                        }
                    )
        ```

        5. Verify that TDE is now enabled for all SQL Databases:

        ```python theme={null}
        # Verify that TDE is now enabled for all SQL Databases
        for server in servers:
            # Get a list of all the SQL Databases in the SQL Server
            databases = sql_client.databases.list_by_server(server.resource_group, server.name)

            # For each SQL Database, check if TDE is enabled
            for database in databases:
                if database.transparent_data_encryption.enabled:
                    print('TDE is enabled for database {} in server {}'.format(database.name, server.name))
                else:
                    print('TDE is not enabled for database {} in server {}'.format(database.name, server.name))
        ```

        These steps will enable TDE for all SQL Databases in all SQL Servers in your Azure subscription. You can run this Python script periodically to ensure that TDE is always enabled for all SQL Databases.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_mssql_database" "SQL_DATABASE_NAME" {
          name           = "SQL_DATABASE_NAME"          # replace with your DB name
          server_id      = azurerm_mssql_server.SQL_SERVER_NAME.id
          sku_name       = "S0"                         # replace with your desired SKU
          collation      = "SQL_Latin1_General_CP1_CI_AS"

          # Enable Transparent Data Encryption (TDE)
          transparent_data_encryption_enabled = true
        }
        ```

        This change is in-place and does not force replacement of the database; Azure will enable TDE on the existing database.

        Verification: `terraform plan` should show `transparent_data_encryption_enabled` changing from `false` (or `null`/omitted) to `true` on the `azurerm_mssql_database` resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>