MySQL Flexible Server enforces SSL connections

Check ID: mysql_flexible_server_ssl_connection_enabled
Provider: Azure
Service: mysql
Severity: HIGH
Categories: encryption
Resource type: microsoft.dbformysql/flexibleservers

What this check verifies

Azure Database for MySQL Flexible Server uses the require_secure_transport parameter to enforce encrypted connections. This evaluation determines whether the server is configured to require TLS/SSL for all client sessions.

Risk

Without TLS enforcement, credentials and queries may traverse the network in cleartext, enabling man-in-the-middle, credential theft, tampering, and data exfiltration. This directly impacts confidentiality and integrity and can lead to compliance violations.

Recommendation

Set require_secure_transport=ON and permit only TLS 1.2+. Ensure clients validate certificates and use FQDNs. Combine with private access (Private Link or VNet), restrictive firewall rules, and least privilege to reduce exposure. Avoid legacy TLS or plaintext connections.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az mysql flexible-server parameter set —resource-group <RESOURCE_GROUP> —server-name <SERVER_NAME> —name require_secure_transport —value ON

# Enforce SSL/TLS on MySQL Flexible Server
resource "azurerm_mysql_flexible_server_configuration" "secure" {
  name                = "require_secure_transport"
  resource_group_name = "<example_resource_group>"
  server_name         = "<example_server_name>"
  value               = "ON" # Critical: enables SSL enforcement
}

// Enforce SSL/TLS by enabling require_secure_transport on MySQL Flexible Server
resource reqSecureTransport 'Microsoft.DBforMySQL/flexibleServers/configurations@2023-12-30' = {
  name: '<example_resource_name>/require_secure_transport'
  properties: {
    value: 'ON' // Critical: turns on SSL enforcement (require_secure_transport)
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = mysql_flexible_server_ssl_connection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

MySQL flexible server enforces TLS 1.2 or higher Azure subscription has at least one Bastion Host

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires