MySQL flexible servers should have 'require_secure_transport' set to 'ON'
Determines whether a MySQL flexible server is configured to require TLS/SSL for all client sessions. The control evaluates the server's secure transport configuration and reports whether encrypted connections are mandatory for every client that connects to the server.
Without TLS enforcement, credentials and queries may traverse the network in cleartext, enabling man-in-the-middle, credential theft, tampering, and data exfiltration. This directly impacts confidentiality and integrity and can lead to compliance violations.
What this control checks
MySQL flexible server parameter require_secure_transport must be ON
Audit evidence
Evidence that deployed resources meet this control: Prowler check mysql_flexible_server_ssl_connection_enabled (prowler azure --checks mysql_flexible_server_ssl_connection_enabled); PowerPipe control azure_compliance.control.mysql_flexible_server_ssl_enabled.
Framework-specific interpretation
SOC 2: Mapped to CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- 4.4.1 Ensure 'Enforce SSL connection' is set to 'Enabled' for Standard MySQL Database Server
- 4.4.1 Ensure 'Enforce SSL connection' is set to 'Enabled' for Standard MySQL Database Server
- 5.3.1 Ensure server parameter 'require_secure_transport' is set to 'ON' for MySQL flexible server
- 164.312(e)(1) Transmission security
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
mysql_flexible_server_ssl_enabled - Powerpipe Control:
azure_compliance.control.mysql_flexible_server_ssl_enabled - Prowler Check:
mysql_flexible_server_ssl_connection_enabled
Last reviewed: 2026-10-13