Description
Transparent Data Encryption (TDE) encrypts Azure SQL Database data files, logs and backups at rest. Disabling it removes TDE protection if storage media or data files are exposed. New databases enable it by default, but verify the actual state of existing databases and restored databases.
TDE does not block authorized SQL queries or encrypt connections. Manage data permissions and TLS separately.
Potential impact
- Exposed stored data loses a layer of confidentiality protection.
- Encryption-at-rest requirements may not be met.
Remediation
Set transparent_data_encryption_enabled = true and verify the actual encryption state. A service-managed key is valid; if your organization requires a customer-managed key, manage its Azure Key Vault permissions and lifecycle. Verify backup retention and restores as well.
Examples
These excerpts compare TDE settings on the same database.
Before
resource "azurerm_mssql_database" "app_database" {
name = "example-db"
server_id = azurerm_mssql_server.example.id
transparent_data_encryption_enabled = false
}
TDE is explicitly disabled.
After
resource "azurerm_mssql_database" "app_database" {
name = "example-db"
server_id = azurerm_mssql_server.example.id
transparent_data_encryption_enabled = true
}
TDE is enabled to protect data files, logs and backups at rest. Maintain key management and data access controls as well.