Ensure Transparent Data Encryption is enabled on every Azure SQL database

高等級 1自動化azure

說明

TDE encrypts database files, backups and logs at rest. Every user database on every logical SQL server must have TDE state Enabled. Read-only Azure CLI calls against the current subscription; credentials come from the CLI's normal sign-in (az login, a service principal or managed identity; select the subscription with az account set). A missing CLI or session fails the check.

檢查方式

稽核方法: Shell 指令

shell

srv=$(az sql server list --query '[].[name,resourceGroup]' -o tsv 2>/dev/null) || exit 1
bad=0
while read -r n g; do
  [ -n "$n" ] || continue
  dbs=$(az sql db list --server "$n" --resource-group "$g" --query '[?name!=`"master"`].name' -o tsv 2>/dev/null </dev/null) || exit 1
  for d in $dbs; do
    s=$(az sql db tde show --server "$n" --resource-group "$g" --database "$d" --query state -o tsv 2>/dev/null </dev/null) || exit 1
    [ "$s" = Enabled ] || { echo "TDE off: $n/$d"; bad=1; }
  done
done <<EOF
$srv
EOF
[ "$bad" -eq 0 ] && echo compliant

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

az sql db tde set --server <server> --resource-group <rg> --database <db> --status Enabled (optionally with a customer managed TDE protector).

屬性

作業系統: 不限
標籤: azuredatabase
參考資料: CIS Microsoft Azure Foundations Benchmark v6.0.0 - Database Services - SQL Database transparent data encryption (verify section number for your release)

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target azure