MySQL flexible server audits CONNECTION events

Check ID: mysql_flexible_server_audit_log_connection_activated
Provider: Azure
Service: mysql
Severity: MEDIUM
Categories: logging
Resource type: microsoft.dbformysql/flexibleservers

What this check verifies

Azure Database for MySQL Flexible Server audit configuration includes the CONNECTION event in audit_log_events.

Risk

Without CONNECTION auditing, login attempts are invisible, weakening detection of brute-force, credential stuffing, and anomalous access. This enables unnoticed account takeover and lateral movement, impacting confidentiality and integrity, and hinders forensics and timely response.

Recommendation

Include CONNECTION in audit_log_events to capture login activity. Centralize and retain audit logs, restrict access by least privilege, and protect logs from tampering. Monitor for anomalous sign-in patterns and alert. Pair with defense-in-depth controls (MFA, network allow-listing) to reduce exposure.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az mysql flexible-server parameter set —resource-group <RESOURCE_GROUP> —server-name <SERVER_NAME> —name audit_log_events —value CONNECTION

resource "azurerm_mysql_flexible_server_configuration" "<example_resource_name>" {
  name                = "audit_log_events"
  resource_group_name = "<example_resource_group>"
  server_name         = "<example_server_name>"
  value               = "CONNECTION" # Critical: includes CONNECTION in audit logs to pass the check
}

// Set MySQL Flexible Server audit_log_events to include CONNECTION
resource cfg 'Microsoft.DBforMySQL/flexibleServers/configurations@2021-05-01' = {
  name: '<example_resource_name>/audit_log_events'
  properties: {
    value: 'CONNECTION' // Critical: ensures 'CONNECTION' is logged, making the check PASS
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = mysql_flexible_server_audit_log_connection_activated. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Activity Log storage account blocks public blob access MySQL flexible server has audit_log_enabled set to ON

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires