TMA-AZURE-SQL-TDE

Ensure Transparent Data Encryption is enabled on every Azure SQL database

高级别 1自动化azure

说明

TDE encrypts database files, backups and logs at rest. Every user database on every logical SQL server must have TDE state Enabled. Read-only Azure CLI calls against the current subscription; credentials come from the CLI's normal sign-in (az login, a service principal or managed identity; select the subscription with az account set). A missing CLI or session fails the check.

检查方式

审计方法: Shell 命令

shell

srv=$(az sql server list --query '[].[name,resourceGroup]' -o tsv 2>/dev/null) || exit 1
bad=0
while read -r n g; do
  [ -n "$n" ] || continue
  dbs=$(az sql db list --server "$n" --resource-group "$g" --query '[?name!=`"master"`].name' -o tsv 2>/dev/null </dev/null) || exit 1
  for d in $dbs; do
    s=$(az sql db tde show --server "$n" --resource-group "$g" --database "$d" --query state -o tsv 2>/dev/null </dev/null) || exit 1
    [ "$s" = Enabled ] || { echo "TDE off: $n/$d"; bad=1; }
  done
done <<EOF
$srv
EOF
[ "$bad" -eq 0 ] && echo compliant

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

az sql db tde set --server <server> --resource-group <rg> --database <db> --status Enabled (optionally with a customer managed TDE protector).

属性

操作系统: 任意
标签: azuredatabase
参考: CIS Microsoft Azure Foundations Benchmark v6.0.0 - Database Services - SQL Database transparent data encryption (verify section number for your release)

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target azure