Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
mysql_flexible_server_minimum_tls_version_12Provider: Azure
Service:
mysqlSeverity: HIGH
Categories:
encryptionResource type:
microsoft.dbformysql/flexibleserversWhat this check verifies
Azure Database for MySQL Flexible Server uses thetls_version setting to permit only modern TLS for client connections, requiring TLSv1.2+ and excluding TLSv1.0 and TLSv1.1.
Risk
Allowing legacy TLS (TLSv1.0/TLSv1.1) weakens confidentiality and integrity of data in transit. Attackers can force downgrades and perform man-in-the-middle interception, exposing credentials and queries or altering results, leading to unauthorized access and data exfiltration.
Recommendation
Enforce a minimum TLS ofTLSv1.2 (prefer TLSv1.3) and disable TLSv1.0/TLSv1.1. Ensure clients and drivers support modern TLS, deprecate weak cipher suites, and validate in staging. Apply defense in depth with private connectivity and restricted network access.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az mysql flexible-server parameter set —resource-group <resourceGroupName> —server-name <serverName> —name tls_version —value TLSv1.2
References
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/MySQL/mysql-flexible-server-tls-version.html
- https://learn.microsoft.com/en-us/azure/mysql/flexible-server/security-tls-how-to-connect
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = mysql_flexible_server_minimum_tls_version_12. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks