Security in Azure Database for MariaDB

There are multiple layers of security that are available to protect the data on your Azure Database for MariaDB server. This article outlines those security options.

Information protection and encryption

In-transit

Azure Database for MariaDB secures your data by encrypting data in-transit with Transport Layer Security. Encryption (SSL/TLS) is enforced by default.

At-rest

The Azure Database for MariaDB service uses the FIPS 140-2 validated cryptographic module for storage encryption of data at-rest. Data, including backups, are encrypted on disk, with the exception of temporary files created while running queries. The service uses the AES 256-bit cipher included in Azure storage encryption, and the keys are system managed. Storage encryption is always on and can't be disabled.

Network security

Connections to an Azure Database for MariaDB server are first routed through a regional gateway. The gateway has a publicly accessible IP, while the server IP addresses are protected. For more information about the gateway, visit the connectivity architecture article.

A newly created Azure Database for MariaDB server has a firewall that blocks all external connections. Though they reach the gateway, they are not allowed to connect to the server.

IP firewall rules

IP firewall rules grant access to servers based on the originating IP address of each request. See the firewall rules overview for more information.

Virtual network firewall rules

Virtual network service endpoints extend your virtual network connectivity over the Azure backbone. Using virtual network rules you can enable your Azure Database for MariaDB server to allow connections from selected subnets in a virtual network. For more information, see the virtual network service endpoint overview.

Access management

While creating the Azure Database for MariaDB server, you provide credentials for an administrator user. This administrator can be used to create additional MariaDB users.

Threat protection

You can opt in to Advanced Threat Protection which detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit servers.

Audit logging is available to track activity in your databases.

Next steps

• Enable firewall rules for IPs or virtual networks