Description
An Azure SQL server-level audit policy records activity in databases on that server. Actual coverage depends on enabled policies, selected events, and log destinations.
Potential impact
Missing audit records can leave insufficient evidence to investigate account activity or changes.
Remediation
Associate azurerm_mssql_server_extended_auditing_policy with the intended server and configure a destination and retention period. Verify that the required events are actually stored.
Examples
The example retains logs in Blob Storage for 90 days. Sending them to Azure Monitor also requires diagnostic settings on the master database; do not reuse the illustrative password in production.
Before
hcl
resource "azurerm_mssql_server" "example" {
name = "mssqlserver"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
version = "12.0"
administrator_login = "mradministrator"
administrator_login_password = "thisIsDog11"
}
resource "azurerm_mssql_database" "example" {
name = "example-db"
server_id = azurerm_mssql_server.example.id
}
After
hcl
resource "azurerm_mssql_server" "example" {
name = "mssqlserver"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
version = "12.0"
administrator_login = "mradministrator"
administrator_login_password = "thisIsDog11"
}
resource "azurerm_mssql_server_extended_auditing_policy" "example" {
server_id = azurerm_mssql_server.example.id
blob_storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint
storage_account_access_key = azurerm_storage_account.example.primary_access_key
storage_account_access_key_is_secondary = false
retention_in_days = 90
log_monitoring_enabled = true
}
resource "azurerm_mssql_database" "example" {
name = "example-db"
server_id = azurerm_mssql_server.example.id
}