Azure Synapse SQL Pool does not have a security alert policy misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_51
Category - Subcategory	Monitoring - Alerting And Notifications
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

This rule detects whether a Synapse SQL Pool has a security alert policy configured. A security alert policy is used to set up alerts for specific security incidents, abnormal activities, and threats in the SQL pool. This is crucial for real-time monitoring and maintaining the security posture of a Synapse workspace, helping to ensure the protection of your data.

How to Fix

Terraform

• Resource: azurerm_synapse_sql_pool
• Arguments: azurerm_synapse_sql_pool_security_alert_policy

Configure a security alert policy for your Synapse SQL Pool. Associate each azurerm_synapse_sql_pool resource with a azurerm_synapse_sql_pool_security_alert_policy block. This block defines the security alert policies for the pool.

In this example, a security alert policy for an Azure Synapse SQL Pool is configured using Terraform templates.

resource "azurerm_synapse_sql_pool" "example" {
  name                 = "examplesqlpool"
  ...
}

+ resource "azurerm_synapse_sql_pool_security_alert_policy" "example" {
+   sql_pool_id                = azurerm_synapse_sql_pool.example.id
+   policy_state               = "Enabled"
+   ...
+ }