Azure SQL Server audit log retention is not greater than 90 days misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_24
Category - Subcategory	Logging - Retention
Provider	AZURE
Severity	HIGH
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

Audit Logs can be used to check for anomalies and give insight into suspected breaches or misuse of information and access. We recommend you configure SQL server audit retention to be greater than 90 days.

How to Fix

Resource: azurerm_sql_server, azurerm_mssql_server

• Arguments: retention_in_days* [source,go]

---

resource "azurerm_sql_server" "example" { ... extended_auditing_policy { storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint storage_account_access_key = azurerm_storage_account.example.primary_access_key storage_account_access_key_is_secondary = true

• retention_in_days = <90 or greater> } }

---