MySQL servers should have 'TLS Version' set to 'TLSV1.2' or higher
Checks that MySQL servers use the latest version of TLS encryption. Checkov CKV_AZURE_54 inspects `ssl_minimal_tls_version_enforced`. Trivy AZU-0026 says you should be using TLS v1.2+.
You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.
What this control checks
MySQL ssl_minimal_tls_version_enforced must be TLS1_2
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.mysql_server_min_tls_1_2.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_54; Trivy check AZU-0026.
Framework-specific interpretation
CIS Azure Benchmark v1.4.0: Mapped to 4.4.2 (Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server).
CIS Azure Benchmark v1.5.0: Mapped to 4.4.2 (Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server).
CIS Azure Benchmark v2.0.0: Mapped to 4.4.2 (Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server).
CIS Azure Benchmark v2.1.0: Mapped to 4.4.2 (Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server).
Framework mappings
The clauses this control is mapped to in each framework.
- 4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server
- 4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server
- 4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server
- 4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
mysql_server_min_tls_1_2 - Checkov Check:
CKV_AZURE_54 - Powerpipe Control:
azure_compliance.control.mysql_server_min_tls_1_2 - Trivy Check:
AZU-0026
Last reviewed: 2026-10-13