Ensure that names like 'Admin' are not used for Azure SQL Server Active Directory Administrator

MEDIUM

Description

Names like azure_superuser, azure_pg_admin, admin, administrator, root, guest, public for an Azure SQL Server Active Directory Administrator account are used, this may make brute force easier for malicious users.

Remediation

Creating administrative users in SQL can be done at multiple stages, however the initial administrator username can only be set at the time the instance is created; changing the username will require a new instance to be created. Before starting, ensure that the user you wish to use is already configured in Azure AD. To create a new instance, follow the steps below.

In Azure Console -

  1. Open the Azure Portal and go SQL Servers.
  2. Select the Create button.
  3. On the Basics tab, ensure that Authentication Method is set to Azure AD.
  4. In the Set Azure AD admin field, select Set admin.
  5. Select the user to use from the list.

In Terraform -
For current Azure Provider versions:

  1. In the azurerm_mssql_server resource, create an azuread_administrator block.
  2. Set login_username to a value that doesn't include well known username values.

For Azure Provider versions prior to 2.99.x:

  1. In the azurerm_sql_active_directory_administrator resource, set login to a value that doesn't include well known username values.
    Examples of well known values: azure_superuser, azure_pg_admin, admin, administrator, root, guest, public

References:
https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-service-principal-tutorial?view=azuresql
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_server
https://registry.terraform.io/providers/hashicorp/azurerm/2.99.0/docs/resources/sql_active_directory_administrator

Policy Details

Rule Reference ID: AC_AZURE_0384
CSP: Azure
Remediation Available: Yes
Resource Category: Database
Resource Type: SQL Server

Frameworks