Add rule for Azure SQL TLS version enforcement (AZ-SQL-TLS-001)

Rule Details

• Rule ID: AZ-SQL-TLS-001
• Severity: HIGH
• Category: Database
• Frameworks: CIS / NIST / ISO 27001 / SOC 2

What does it detect?

This rule detects Azure SQL Servers that do not enforce a minimum TLS version of TLS 1.2 or higher.

It should flag:

-Servers where minimalTlsVersion is missing

-Servers where minimalTlsVersion is TLS1_0 or TLS1_1

-Servers using any TLS version below TLS1_2

Detection logic

-Query Azure SQL Server resources:
Microsoft.Sql/servers

• Read the property:
  properties.minimalTlsVersion

-If the value is:

• null
• "TLS1_0"
• "TLS1_1"
  → return a HIGH severity finding.

• If the value is "TLS1_2" or "TLS1_3" → pass.

Why is this a security risk?

TLS 1.0 and TLS 1.1 are deprecated and vulnerable to downgrade attacks.
Azure requires TLS 1.2+ for secure communication, and major compliance frameworks mandate it:

*CIS Azure Foundations Benchmark
*NIST 800-53 SC-13
*ISO 27001 A.10.1
*SOC 2 CC6.7

Enforcing TLS 1.2+ ensures encrypted connections and prevents insecure fallback.

Remediation steps

To fix this issue, update the SQL Server to enforce TLS 1.2 or higher.

Azure CLI

az sql server update
--name
--resource-group
--minimal-tls-version TLS1_2

Azure Portal

1. Go to the SQL Server resource.
2. Open Networking.
3. Scroll to Minimum TLS Version.
4. Set the value to TLS 1.2 or TLS 1.3.
5. Save changes.

Policy-based remediation (optional)

Apply Azure Policy:
"SQL servers should have a minimum TLS version of 1.2"

Test plan

• Tested against real Azure free trial subscription
• Compliant case (TLS1_2 or TLS1_3) returns no findings
• Non-compliant case (TLS1_0 or TLS1_1) returns correct HIGH severity finding
• CLI playbook written and tested using Azure CLI
• All four compliance framework JSONs updated (CIS, NIST, ISO 27001, SOC 2)

Start by locating the existing Azure resource rules, Azure SQL server queries, test fixtures, and CIS, NIST, ISO 27001, and SOC 2 framework JSONs. Implement checks for missing or pre-TLS1_2 minimalTlsVersion values, then verify compliant and non-compliant cases, HIGH severity output, framework mappings, and the Azure CLI remediation playbook.