Azure Synapse Workspace does not have extended audit logs misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_53
Category - Subcategory	Logging - Disabled or missing
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

This rule detects whether extended audit logs are disabled on an Azure Synapse Workspace. Logging mechanisms are essential for tracking user actions, policy breaches, data access, and troubleshooting issues, making it a critical practice for maintaining security and compliance within Azure environments. Extended audit logs provide detailed records of access and activity within the workspace, which are crucial for monitoring and investigating potential security risks like unauthorized access or anomalies.

How to Fix

Terraform

• Resource: azurerm_synapse_workspace
• Arguments: azurerm_synapse_workspace_extended_auditing_policy

Ensure that all azurerm_synapse_workspace resources are connected to a azurerm_synapse_workspace_extended_auditing_policy. In this example, extended audit logging is configured for your Terraform templates.

resource "azurerm_synapse_workspace" "example" {
  ...
}

resource "azurerm_synapse_workspace_extended_auditing_policy" "example" {
  synapse_workspace_id                    = azurerm_synapse_workspace.example.id
  ...
}