Azure SQL server not configured with Active Directory admin authentication misconfiguration detected

Azure SQL server not configured with Active Directory admin authentication misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_27
Category - Subcategory	IAM - Authentication Policies
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	186ce6b6-15d4-409c-b864-7c62922ef198

Impact

Azure AD authentication is a mechanism of connecting to Azure SQL Database by using identities in Azure AD. With Azure AD authentication, you can manage the identities of database users and other Microsoft services in one central location. It offers benefits like Multi-Factor Authentication, identity protection, and seamless domain join.

This rule ensures that Azure AD authentication is enabled for Azure SQL (MSSQL) by checking for the existence of the azuread_administrator attribute in the azurerm_mssql_server resource and verifying that the login_username attribute within azuread_administrator has a valid value (i.e., not only whitespaces).

How to Fix

Resource:

• azurerm_mssql_server

Arguments:

• azuread_administrator
• azuread_administrator.login_username [source,go]

---

resource "azurerm_mssql_server" "example" { name = "example-mssqlserver" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location

... other configurations ...

• azuread_administrator {
• login_username = "example_admin"
• object_id = "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
• tenant_id = "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
• } }

---