TMA-AZURE-SQL-TDE

Ensure Transparent Data Encryption is enabled on every Azure SQL database

높음레벨 1자동azure

설명

TDE encrypts database files, backups and logs at rest. Every user database on every logical SQL server must have TDE state Enabled. Read-only Azure CLI calls against the current subscription; credentials come from the CLI's normal sign-in (az login, a service principal or managed identity; select the subscription with az account set). A missing CLI or session fails the check.

점검 방법

감사 방식: 셸 명령

shell

srv=$(az sql server list --query '[].[name,resourceGroup]' -o tsv 2>/dev/null) || exit 1
bad=0
while read -r n g; do
  [ -n "$n" ] || continue
  dbs=$(az sql db list --server "$n" --resource-group "$g" --query '[?name!=`"master"`].name' -o tsv 2>/dev/null </dev/null) || exit 1
  for d in $dbs; do
    s=$(az sql db tde show --server "$n" --resource-group "$g" --database "$d" --query state -o tsv 2>/dev/null </dev/null) || exit 1
    [ "$s" = Enabled ] || { echo "TDE off: $n/$d"; bad=1; }
  done
done <<EOF
$srv
EOF
[ "$bad" -eq 0 ] && echo compliant

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

az sql db tde set --server <server> --resource-group <rg> --database <db> --status Enabled (optionally with a customer managed TDE protector).

속성

운영 체제: 모두
태그: azuredatabase
참고 자료: CIS Microsoft Azure Foundations Benchmark v6.0.0 - Database Services - SQL Database transparent data encryption (verify section number for your release)

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target azure