MariaDB servers should have geo-redundant backup enabled
Azure Database for MariaDB allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage, replicated to a paired region. Configuring geo-redundant storage for backup is only allowed during server create.
Geo-redundant storage means the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure.
What this control checks
Geo-redundant backup configuration on MariaDB servers
Common pitfalls
Geo-redundant storage only allowed during server create
Configuring geo-redundant storage for backup is only allowed during server create.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Geo-redundant backup should be enabled for Azure Database for MariaDB" (0ec47710-77ff-4a3d-9181-6aa50af424d0); PowerPipe control azure_compliance.control.mariadb_server_geo_redundant_backup_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_129; KICS query "MariaDB Server Geo-redundant Backup Disabled" (0a70d5f3-1ecd-4c8e-9292-928fc9a8c4f1).
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to CP-6 (Alternate Storage Site), CP-6(1) (Separation from Primary Site) and CP-9 (System Backup).
FedRAMP Moderate Baseline Rev 4: Mapped to CP-6 (Alternate Storage Sites), CP-6(1) (Separation From Primary Site) and CP-9 (Information System Backup).
Framework mappings
The clauses this control is mapped to in each framework.
- CP-6 Alternate Storage Site
- CP-6(1) Separation From Primary Site
- CP-9 System Backup
FedRAMP Moderate Baseline Rev 4
- CP-6 Alternate Storage Sites
- CP-6(1) Separation From Primary Site
- CP-9: Information System Backup
- 3.8.9: Protect the confidentiality of backup CUI at storage locations.
- 5.2 Policy for Information System Audit (IS Audit)
- 6 Business Continuity Planning (BCP) and Disaster Recovery
- 6.2 Recovery strategy / Contingency Plan
- 6.3 Backup and Recovery
- MP.L2-3.8.9 Protect the confidentiality of backup CUI at storage locations
- CP-6 Alternate Storage Sites
- CP-6(1) Separation From Primary Site
- CP-9 System Backup
- 1619.09l1Organizational.7-09.l 09.05 Information Back-Up
- 1624.09l3Organizational.12-09.l 09.05 Information Back-Up
- 1627.09l3Organizational.6-09.l 09.05 Information Back-Up
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
mariadb_server_geo_redundant_backup_enabled - Checkov Check:
CKV_AZURE_129 - Powerpipe Control:
azure_compliance.control.mariadb_server_geo_redundant_backup_enabled - Azure Policy Definition:
0ec47710-77ff-4a3d-9181-6aa50af424d0 - KICS Query:
0a70d5f3-1ecd-4c8e-9292-928fc9a8c4f1
Last reviewed: 2026-10-13