Policy Settings

The Azure CIS v2.0.0 - Section 4 - Database Services policy pack has 36 policy settings:

Policy	Setting	Note
Azure > Cosmos DB > Database Account > Firewall	Check: Allow only approved virtual networks and IP ranges	Azure CIS v2.0.0 - Control: 4.5.1
Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required	Check: Required > Items	Azure CIS v2.0.0 - Control: 4.5.1
Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required > Items	- "45.127.45.223" - "45.127.45.221"	Azure CIS v2.0.0 - Control: 4.5.1
Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required	Check: Required > Items	Azure CIS v2.0.0 - Control: 4.5.1
Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required > Items	- "/subscriptions/1234ae5d-678b-901d-2f34-56b7890fc1c2/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVirtualNetwork/subnets/mySubnet"	Azure CIS v2.0.0 - Control: 4.5.1
Azure > MySQL > Flexible Server > Encryption in Transit	Check: Enabled	Azure CIS v2.0.0 - Control: 4.4.1
Azure > MySQL > Flexible Server > Minimum TLS Version	Check: TLS 1.2	Azure CIS v2.0.0 - Control: 4.4.2
Azure > MySQL > Server > Encryption in Transit	Check: Enabled	Azure CIS v2.0.0 - Control: 4.4.1
Azure > Network > Network Security Group > Ingress Rules > Approved	Check: Approved	Azure CIS v2.0.0 - Control: 4.1.2
Azure > Network > Network Security Group > Ingress Rules > Approved > Rules	REJECT $.turbot.cidr:0.0.0.0/0 APPROVE *	Azure CIS v2.0.0 - Control: 4.1.2
Azure > PostgreSQL > Flexible Server > Audit Logging	Check: Audit Logging > *	Azure CIS v2.0.0 - Control: 4.3.2
Azure > PostgreSQL > Flexible Server > Audit Logging > Log Checkpoints	On	Azure CIS v2.0.0 - Control: 4.3.2
Azure > PostgreSQL > Flexible Server > Encryption in Transit	Check: Enabled	Azure CIS v2.0.0 - Control: 4.3.1
Azure > PostgreSQL > Server > Approved	Check: Approved	Azure CIS v2.0.0 - Control: 4.3.7 and 4.3.8
Azure > PostgreSQL > Server > Approved > Custom	Calculated	Azure CIS v2.0.0 - Control: 4.3.7 and 4.3.8
Azure > PostgreSQL > Server > Audit Logging	Check: Audit Logging > *	Azure CIS v2.0.0 - Control: 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7 and 4.3.8
Azure > PostgreSQL > Server > Audit Logging > Connection Throttling	On	Azure CIS v2.0.0 - Control: 4.3.5
Azure > PostgreSQL > Server > Audit Logging > Log Checkpoints	On	Azure CIS v2.0.0 - Control: 4.3.2
Azure > PostgreSQL > Server > Audit Logging > Log Connections	On	Azure CIS v2.0.0 - Control: 4.3.3
Azure > PostgreSQL > Server > Audit Logging > Log Disconnections	On	Azure CIS v2.0.0 - Control: 4.3.4
Azure > PostgreSQL > Server > Audit Logging > Log Retention Days	>= 4 Days	Azure CIS v2.0.0 - Control: 4.3.6
Azure > PostgreSQL > Server > Encryption in Transit	Check: Enabled	Azure CIS v2.0.0 - Control: 4.3.1
Azure > SQL > Database > Encryption at Rest	Check: Enabled	Azure CIS v2.0.0 - Control: 4.1.5
Azure > SQL > Server > Active Directory Administrator	Check: Enabled to Active Directory Administrator > Name	Azure CIS v2.0.0 - Control: 4.1.4
Azure > SQL > Server > Active Directory Administrator > Name	myAdminUser	Azure CIS v2.0.0 - Control: 4.1.4
Azure > SQL > Server > Advanced Data Security	Check: Enabled	Azure CIS v2.0.0 - Control: 4.2.1, 4.2.2, 4.2.3, 4.2.4 and 4.2.5
Azure > SQL > Server > Advanced Data Security > Threat Protection > Email Addresses	- "email@example.com"	Azure CIS v2.0.0 - Control: 4.2.1
Azure > SQL > Server > Advanced Data Security > Threat Protection > Notify Admins	Enabled	Azure CIS v2.0.0 - Control: 4.2.1
Azure > SQL > Server > Advanced Data Security > Threat Protection > Types	- "SQL Injection" - "SQL Injection Vulnerability" - "Data Exfiltration" - "Unsafe Action" - "Access Anomaly" - "Brute Force"	Azure CIS v2.0.0 - Control: 4.2.1
Azure > SQL > Server > Advanced Data Security > Vulnerability Assessment > Periodic Scans	Enabled	Azure CIS v2.0.0 - Control: 4.2.3
Azure > SQL > Server > Advanced Data Security > Vulnerability Assessment > Periodic Scans > Email Addresses	- "email@example.com"	Azure CIS v2.0.0 - Control: 4.2.4
Azure > SQL > Server > Advanced Data Security > Vulnerability Assessment > Periodic Scans > Notify Admins	Enabled	Azure CIS v2.0.0 - Control: 4.2.5
Azure > SQL > Server > Advanced Data Security > Vulnerability Assessment > Storage Account	mystorageaccount	Azure CIS v2.0.0 - Control: 4.2.2
Azure > SQL > Server > Auditing	Check: Enabled	Azure CIS v2.0.0 - Control: 4.1.1 and 4.1.6
Azure > SQL > Server > Auditing > Retention Days	90	Azure CIS v2.0.0 - Control: 4.1.1 and 4.1.6
Azure > SQL > Server > Auditing > Storage Account	mystorageaccount	Azure CIS v2.0.0 - Control: 4.1.1 and 4.1.6