​
Event Information

  1. The Microsoft.DBforMariaDB.servers.keys.delete event in Azure for Azure Database Service indicates that a key associated with a MariaDB server has been deleted.
  2. This event signifies that a specific key, which is used for authentication and access control purposes, has been removed from the MariaDB server.
  3. It is important to monitor this event as it can help track any changes made to the keys associated with the MariaDB server, ensuring the security and integrity of the database.

​
Examples

  1. Unauthorized access: If security is impacted with Microsoft.DBforMariaDB.servers.keys.delete in Azure for Azure Database Service, it could potentially allow unauthorized individuals to delete encryption keys associated with the MariaDB server. This could lead to unauthorized access to sensitive data stored in the database, compromising the confidentiality and integrity of the data.

  2. Data loss: Deleting encryption keys without proper authorization can result in the loss of access to encrypted data. If the encryption keys are deleted, it may become impossible to decrypt the data, rendering it permanently inaccessible. This can have severe consequences for businesses, especially if the data is critical or sensitive.

  3. Compliance violations: Deleting encryption keys without proper authorization can also lead to compliance violations. Many regulatory frameworks require the use of encryption to protect sensitive data. If encryption keys are deleted, it may result in non-compliance with these regulations, leading to potential legal and financial consequences for the organization.

​
Remediation

​
Using Console

To remediate the issues for Azure Database Service using the Azure console, you can follow these step-by-step instructions:

  1. Enable auditing for Azure SQL Database:

    • Go to the Azure portal and navigate to the Azure SQL Database service.
    • Select the specific database you want to enable auditing for.
    • In the left-hand menu, under the Security section, click on “Auditing”.
    • Click on “Enable” to enable auditing for the database.
    • Configure the desired audit settings, such as storage account, retention period, and events to audit.
    • Click on “Save” to apply the changes.

  2. Enable encryption for Azure Storage:

    • Go to the Azure portal and navigate to the Azure Storage account.
    • Select the specific storage account you want to enable encryption for.
    • In the left-hand menu, under the Settings section, click on “Encryption”.
    • Enable the “Encryption at rest” option.
    • Choose the desired encryption type, such as Microsoft-managed keys or customer-managed keys.
    • Click on “Save” to apply the changes.

  3. Enable logging for Azure App Service:

    • Go to the Azure portal and navigate to the Azure App Service.
    • Select the specific app service you want to enable logging for.
    • In the left-hand menu, under the Monitoring section, click on “Diagnostic settings”.
    • Click on “Add diagnostic setting” to create a new diagnostic setting.
    • Provide a name for the diagnostic setting and select the desired logs and metrics to enable.
    • Choose the desired destination for the logs, such as Azure Storage or Azure Event Hubs.
    • Click on “Save” to apply the changes.

Note: The above instructions are general guidelines and may vary slightly depending on the specific Azure services and console versions you are using. It is always recommended to refer to the official Azure documentation for detailed and up-to-date instructions.

​
Using CLI

To remediate issues related to Azure Database Service using Azure CLI, you can follow these steps:

  1. Enable auditing for Azure SQL Database:

    • Use the az sql server update-auditing command to enable auditing for the Azure SQL Server.
    • Specify the necessary parameters such as --state Enabled and --storage-account-resource-id to configure auditing settings.
    • Example command: az sql server update-auditing --resource-group <resource-group-name> --server <server-name> --state Enabled --storage-account-resource-id <storage-account-resource-id>

  2. Enable diagnostic settings for Azure SQL Database:

    • Use the az monitor diagnostic-settings create command to enable diagnostic settings for the Azure SQL Database.
    • Specify the necessary parameters such as --name, --resource-id, and --workspace to configure diagnostic settings.
    • Example command: az monitor diagnostic-settings create --name <diagnostic-settings-name> --resource <database-resource-id> --workspace <workspace-id>

  3. Enable threat detection for Azure SQL Database:

    • Use the az sql db threat-policy update command to enable threat detection for the Azure SQL Database.
    • Specify the necessary parameters such as --name, --resource-group, --server, and --state to configure threat detection settings.
    • Example command: az sql db threat-policy update --name <database-name> --resource-group <resource-group-name> --server <server-name> --state Enabled

Please note that you need to replace the placeholders <resource-group-name>, <server-name>, <storage-account-resource-id>, <diagnostic-settings-name>, <database-resource-id>, <workspace-id>, and <database-name> with the actual values specific to your Azure environment.

​
Using Python

To remediate issues related to Azure Database Service using Python, you can follow these steps:

  1. Monitor and alert on database service events:

    • Use the Azure Monitor service to set up alerts for specific events or metrics related to your Azure Database Service.
    • Create an alert rule using the Azure SDK for Python to trigger an action when a specific event occurs.
    • Use the Azure Event Grid service to publish events to a topic and subscribe to those events using Python to take necessary actions.

  2. Automate database backups:

    • Use the Azure SDK for Python to create a script that automates the backup process for your Azure Database Service.
    • Set up a scheduled task or a cron job to run the script at regular intervals.
    • Ensure that the script includes error handling and logging to capture any issues during the backup process.

  3. Implement security best practices:

    • Use the Azure SDK for Python to configure firewall rules and virtual network service endpoints to restrict access to your Azure Database Service.
    • Enable auditing and threat detection for your database service using the Azure SDK for Python to detect and respond to potential security threats.
    • Regularly review and update the access control policies for your Azure Database Service using Python scripts to ensure compliance with security standards.

Please note that the provided examples are conceptual and may require customization based on your specific requirements and the Azure Database Service you are using.