MySQL servers should have 'Enforce SSL connection' enabled
Azure Database for MySQL supports connecting your server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections helps protect against 'man in the middle' attacks by encrypting the data stream. SSL is always enabled for access.
Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application.
What this control checks
MySQL servers must have 'Enforce SSL connection' set to Enabled (ssl_enforcement_enabled true).
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Enforce SSL connection should be enabled for MySQL database servers" (e802a67a-daf5-4436-9ea6-f6d821dd0c5d); PowerPipe control azure_compliance.control.mysql_ssl_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_28; KICS query "MySQL SSL Connection Disabled" (73e42469-3a86-4f39-ad78-098f325b4e9f); Trivy check AZU-0020.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-8 (Transmission Confidentiality and Integrity) and SC-8(1) (Cryptographic Protection).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-8 (Transmission Confidentiality And Integrity) and SC-8(1) (Cryptographic Or Alternate Physical Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
FedRAMP Moderate Baseline Rev 4
- SC-8 (1): Cryptographic Or Alternate Physical Protection
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- 3.1.h Public Key Infrastructure (PKI)
- 4.3.2 Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server
- 4.4.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server
- 4.4.1 Ensure 'Enforce SSL connection' is set to 'Enabled' for Standard MySQL Database Server
- 4.4.1 Ensure 'Enforce SSL connection' is set to 'Enabled' for Standard MySQL Database Server
- 4.4.1 Ensure 'Enforce SSL connection' is set to 'Enabled' for Standard MySQL Database Server
- SC.L2-3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards
- SC-8 Transmission Confidentiality And Integrity
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 0809.01n2Organizational.1234-01.n 01.04 Network Access Control
- 0810.01n2Organizational.5-01.n 01.04 Network Access Control
- 0811.01n2Organizational.6-01.n 01.04 Network Access Control
- 0812.01n2Organizational.8-01.n 01.04 Network Access Control
- 0814.01n1Organizational.12-01.n 01.04 Network Access Control
1 more clause
- 0948.09y2Organizational.3-09.y 09.09 Electronic Commerce Services
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
mysql_ssl_enabled - Checkov Check:
CKV_AZURE_28 - Powerpipe Control:
azure_compliance.control.mysql_ssl_enabled - Azure Policy Definition:
e802a67a-daf5-4436-9ea6-f6d821dd0c5d - KICS Query:
73e42469-3a86-4f39-ad78-098f325b4e9f - Trivy Check:
AZU-0020
Last reviewed: 2026-10-13