feat: add rule AZ-DB-008 SQL Server minimum TLS version below 1.2

compliance/frameworks/cis_azure_benchmark.json

@@ -41,6 +41,7 @@
     "AZ-DB-005": {"control_id": "N/A-DB-005", "control_name": "SQL Server Microsoft Entra-Only Authentication Not Enforced", "description": "Service-specific OpenShield control."},
     "AZ-DB-006": {"control_id": "N/A-DB-006", "control_name": "SQL Vulnerability Assessment Not Configured", "description": "Service-specific OpenShield control."},
     "AZ-DB-007": {"control_id": "N/A-DB-007", "control_name": "SQL Auditing Retention Below Minimum", "description": "Service-specific OpenShield control."},
+    "AZ-DB-008": {"control_id": "N/A-DB-008", "control_name": "SQL Server Minimum TLS Version Below 1.2", "description": "CIS Azure Foundations has no numbered control specifically for the SQL server minimum TLS version setting (confirmed against the official CIS Azure Foundations Benchmark 2.0.0 mapping); the storage-account minimum TLS control (3.15) does not apply to Microsoft.Sql/servers, so this control is not assigned a fabricated numbered mapping."},
     "AZ-COSMOS-001": {"control_id": "N/A-COSMOS-001", "control_name": "Cosmos DB Local Authentication Enabled", "description": "Service-specific OpenShield control."},
     "AZ-COSMOS-002": {"control_id": "N/A-COSMOS-002", "control_name": "Cosmos DB Public Network Access Enabled", "description": "Service-specific OpenShield control."},
     "AZ-CACHE-001": {"control_id": "N/A-CACHE-001", "control_name": "Managed Cache Public or Non-TLS Access", "description": "Service-specific OpenShield control."},

compliance/frameworks/iso27001.json

@@ -41,6 +41,7 @@
     "AZ-DB-005": {"control_id": "A.9.4.2", "control_name": "Secure log-on procedures", "description": "SQL authentication is restricted to approved Entra identities."},
     "AZ-DB-006": {"control_id": "A.12.6.1", "control_name": "Management of technical vulnerabilities", "description": "Required SQL vulnerability assessment is configured."},
     "AZ-DB-007": {"control_id": "A.12.4.1", "control_name": "Event logging", "description": "SQL audit logs are retained according to policy."},
+    "AZ-DB-008": {"control_id": "A.10.1.1", "control_name": "Policy on the use of cryptographic controls", "description": "SQL Server minimum TLS version applies cryptographic controls to data in transit. A policy on the use of cryptographic controls for protection of information should be developed and implemented."},
     "AZ-COSMOS-001": {"control_id": "A.9.4.2", "control_name": "Secure log-on procedures", "description": "Cosmos authentication is restricted to approved Entra identities."},
     "AZ-COSMOS-002": {"control_id": "A.13.1.1", "control_name": "Network controls", "description": "Cosmos public network access is restricted according to policy."},
     "AZ-CACHE-001": {"control_id": "A.13.1.1", "control_name": "Network controls", "description": "Managed cache access is private and uses approved TLS."},

compliance/frameworks/nist_csf.json

@@ -41,6 +41,7 @@
     "AZ-DB-005": {"control_id": "PR.AC-6", "control_name": "Identity proofing and authentication", "description": "SQL authentication is restricted to approved Entra identities."},
     "AZ-DB-006": {"control_id": "DE.CM-8", "control_name": "Vulnerability scans are performed", "description": "Required SQL vulnerability assessment is configured."},
     "AZ-DB-007": {"control_id": "PR.PT-1", "control_name": "Audit/log records are determined, documented, implemented, and reviewed", "description": "SQL audit logs are retained for at least 90 days in accordance with the defined audit policy."},
+    "AZ-DB-008": {"control_id": "PR.DS-2", "control_name": "Data-in-transit is protected", "description": "Enforcing a minimum TLS version of 1.2 on the SQL server ensures data in transit between clients and the database is protected using current, secure protocols."},
     "AZ-COSMOS-001": {"control_id": "PR.AC-6", "control_name": "Identity proofing and authentication", "description": "Cosmos authentication is restricted to approved Entra identities."},
     "AZ-COSMOS-002": {"control_id": "PR.AC-5", "control_name": "Network integrity is protected", "description": "Cosmos public network access is restricted according to policy."},
     "AZ-CACHE-001": {"control_id": "PR.AC-5", "control_name": "Network integrity is protected", "description": "Managed cache access is private and uses approved TLS."},

compliance/frameworks/soc2.json

@@ -41,6 +41,7 @@
     "AZ-DB-005": {"control_id": "CC6.3", "control_name": "Logical access security", "description": "SQL authentication is restricted to approved Entra identities."},
     "AZ-DB-006": {"control_id": "CC7.1", "control_name": "Detection of security events", "description": "Required SQL vulnerability assessment is configured."},
     "AZ-DB-007": {"control_id": "CC7.2", "control_name": "System monitoring", "description": "SQL audit logs are retained according to policy."},
+    "AZ-DB-008": {"control_id": "CC6.7", "control_name": "Protects Data in Transit", "description": "The SQL server does not enforce a minimum TLS version of 1.2. CC6.7 requires that data transmitted over networks is protected using encryption. Enforcing TLS 1.2 minimum ensures secure protocols are used for all connections."},
     "AZ-COSMOS-001": {"control_id": "CC6.3", "control_name": "Logical access security", "description": "Cosmos authentication is restricted to approved Entra identities."},
     "AZ-COSMOS-002": {"control_id": "CC6.6", "control_name": "Logical access security measures", "description": "Cosmos public network access is restricted according to policy."},
     "AZ-CACHE-001": {"control_id": "CC6.6", "control_name": "Logical access security measures", "description": "Managed cache access is private and uses approved TLS."},

playbooks/cli/fix_az_db_008.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# Playbook: fix_az_db_008.sh
+# Rule: AZ-DB-008 — Azure SQL Server minimum TLS version below 1.2
+
+set -euo pipefail
+
+if [[ $# -lt 1 ]]; then
+  echo "Usage: $0 <subscription_id>"
+  exit 1
+fi
+
+SUBSCRIPTION_ID="$1"
+
+echo "Setting subscription..."
+az account set --subscription "$SUBSCRIPTION_ID"
+
+echo "Fetching Azure SQL Servers..."
+SERVERS=$(az sql server list --subscription "$SUBSCRIPTION_ID" --query "[].{name:name, rg:resourceGroup}" --output tsv)
+
+if [[ -z "$SERVERS" ]]; then
+  echo "No Azure SQL Servers found."
+  exit 0
+fi
+
+while IFS=$'\t' read -r SERVER_NAME RESOURCE_GROUP; do
+  echo "Checking $SERVER_NAME in $RESOURCE_GROUP..."
+  TLS_VERSION=$(az sql server show --name "$SERVER_NAME" --resource-group "$RESOURCE_GROUP" --query "minimalTlsVersion" --output tsv 2>/dev/null || echo "")
+
+  if [[ "$TLS_VERSION" != "1.2" && "$TLS_VERSION" != "1.3" ]]; then
+    echo "Setting minimum TLS version to 1.2 on $SERVER_NAME..."
+    az sql server update --name "$SERVER_NAME" --resource-group "$RESOURCE_GROUP" --minimal-tls-version 1.2 --output none
+    echo "Done."
+  else
+    echo "$SERVER_NAME already enforces TLS $TLS_VERSION, skipping."
+  fi
+done <<< "$SERVERS"
+
+echo "Done. Verify with:"
+echo "  az sql server show --name <name> --resource-group <rg> --query minimalTlsVersion"

scanner/rules/az_db_008.py

@@ -0,0 +1,61 @@
+"""AZ-DB-008: Azure SQL Server does not enforce a minimum TLS version of 1.2."""
+
+from typing import Any, Dict, List
+
+RULE_ID = "AZ-DB-008"
+RULE_NAME = "Azure SQL Server Minimum TLS Version Below 1.2"
+SEVERITY = "HIGH"
+CATEGORY = "Database"
+FRAMEWORKS = {"CIS": "N/A-DB-008", "NIST": "PR.DS-2", "ISO27001": "A.10.1.1", "SOC2": "CC6.7"}
+DESCRIPTION = (
+    "The Azure SQL Server does not enforce a minimum TLS version of 1.2 or higher. "
+    "Connections are still able to negotiate the deprecated TLS 1.0 or 1.1 protocols, "
+    "or no minimum is set at all, leaving data in transit exposed to known protocol "
+    "downgrade and interception weaknesses in those older versions."
+)
+REMEDIATION = (
+    "Set the server's minimum TLS version to 1.2. "
+    "Run: az sql server update --name <server-name> --resource-group <resource-group> "
+    "--minimal-tls-version 1.2"
+)
+PLAYBOOK = "playbooks/cli/fix_az_db_008.sh"
+
+# The Server model's minimal_tls_version is a free string, not an enum, and the
+# real Azure API allows "None" (no minimum enforced) alongside "1.0"/"1.1"/"1.2"/
+# "1.3" -- a missing attribute (None) must be treated the same as an explicit
+# below-1.2 value, not skipped, since both mean TLS 1.2 is not being enforced.
+_COMPLIANT_VERSIONS = {"1.2", "1.3"}
+
+
+def scan(azure_client: Any, subscription_id: str) -> List[Dict[str, Any]]:
+    """Detect Azure SQL Servers whose minimum TLS version is below 1.2 or unset."""
+    findings: List[Dict[str, Any]] = []
+
+    for server in azure_client.get_sql_servers():
+        parsed = azure_client.parse_resource_id(server.id)
+        resource_group = parsed.get("resource_group", "")
+        tls_version = getattr(server, "minimal_tls_version", None)
+
+        if tls_version not in _COMPLIANT_VERSIONS:
+            findings.append(
+                {
+                    "rule_id": RULE_ID,
+                    "rule_name": RULE_NAME,
+                    "severity": SEVERITY,
+                    "category": CATEGORY,
+                    "resource_id": server.id,
+                    "resource_name": server.name,
+                    "resource_type": "Microsoft.Sql/servers",
+                    "description": DESCRIPTION,
+                    "remediation": REMEDIATION,
+                    "playbook": PLAYBOOK,
+                    "frameworks": FRAMEWORKS,
+                    "metadata": {
+                        "resource_group": resource_group,
+                        "location": getattr(server, "location", ""),
+                        "minimal_tls_version": tls_version or "not set",
+                    },
+                }
+            )
+
+    return findings

tests/test_rules_database.py

@@ -6,6 +6,7 @@
 import scanner.rules.az_db_002 as az_db_002
 import scanner.rules.az_db_003 as az_db_003
 import scanner.rules.az_db_004 as az_db_004
+import scanner.rules.az_db_008 as az_db_008
 from tests.helpers.mock_azure import make_resource
 
 try:
@@ -255,3 +256,61 @@ def test_db_003_noncompliant_returns_one_finding(mock_azure, subscription_id):
     assert findings[0]["rule_id"] == "AZ-DB-003"
     assert findings[0]["severity"] == "HIGH"
     assert findings[0]["resource_name"] == "pgflex-nossl"
+
+
+# ── AZ-DB-008: SQL server minimum TLS version below 1.2 ────────────────────
+
+
+def test_db_008_compliant_tls_1_2_returns_no_findings(mock_azure, subscription_id):
+    server = make_resource(id=_sql_id("sql-tls12"), name="sql-tls12", minimal_tls_version="1.2")
+    mock_azure.set_sql_servers([server])
+    assert az_db_008.scan(mock_azure, subscription_id) == []
+
+
+def test_db_008_compliant_tls_1_3_returns_no_findings(mock_azure, subscription_id):
+    server = make_resource(id=_sql_id("sql-tls13"), name="sql-tls13", minimal_tls_version="1.3")
+    mock_azure.set_sql_servers([server])
+    assert az_db_008.scan(mock_azure, subscription_id) == []
+
+
+def test_db_008_noncompliant_tls_1_0_returns_one_finding(mock_azure, subscription_id):
+    server = make_resource(id=_sql_id("sql-tls10"), name="sql-tls10", minimal_tls_version="1.0")
+    mock_azure.set_sql_servers([server])
+    findings = az_db_008.scan(mock_azure, subscription_id)
+    assert len(findings) == 1
+    finding = findings[0]
+    assert _REQUIRED_FIELDS.issubset(finding.keys())
+    assert finding["rule_id"] == "AZ-DB-008"
+    assert finding["severity"] == "HIGH"
+    assert finding["category"] == "Database"
+    assert finding["resource_name"] == "sql-tls10"
+    assert finding["resource_type"] == "Microsoft.Sql/servers"
+    assert finding["metadata"]["resource_group"] == _RG
+    assert finding["metadata"]["minimal_tls_version"] == "1.0"
+
+
+def test_db_008_noncompliant_tls_1_1_returns_one_finding(mock_azure, subscription_id):
+    server = make_resource(id=_sql_id("sql-tls11"), name="sql-tls11", minimal_tls_version="1.1")
+    mock_azure.set_sql_servers([server])
+    findings = az_db_008.scan(mock_azure, subscription_id)
+    assert len(findings) == 1
+    assert findings[0]["rule_id"] == "AZ-DB-008"
+
+
+def test_db_008_noncompliant_explicit_none_returns_one_finding(mock_azure, subscription_id):
+    """The real Azure API allows an explicit 'None' string meaning no minimum is enforced,
+    distinct from the attribute simply being unset."""
+    server = make_resource(id=_sql_id("sql-tls-none"), name="sql-tls-none", minimal_tls_version="None")
+    mock_azure.set_sql_servers([server])
+    findings = az_db_008.scan(mock_azure, subscription_id)
+    assert len(findings) == 1
+    assert findings[0]["metadata"]["minimal_tls_version"] == "None"
+
+
+def test_db_008_missing_attribute_defaults_to_noncompliant(mock_azure, subscription_id):
+    """A server with no minimal_tls_version attribute at all must not be silently skipped."""
+    server = make_resource(id=_sql_id("sql-tls-unset"), name="sql-tls-unset")
+    mock_azure.set_sql_servers([server])
+    findings = az_db_008.scan(mock_azure, subscription_id)
+    assert len(findings) == 1
+    assert findings[0]["metadata"]["minimal_tls_version"] == "not set"