MEDIUM
Source
Trivy
ID
AVD-AZU-0018

At least one email address is set for threat alerts

SQL Server sends alerts for threat detection via email, if there are no email addresses set then mitigation will be delayed.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Provide at least one email address for threat alerts

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
 resource "azurerm_mssql_server_security_alert_policy" "good_example" {
   resource_group_name        = azurerm_resource_group.example.name
   server_name                = azurerm_sql_server.example.name
   state                      = "Enabled"
   storage_endpoint           = azurerm_storage_account.example.primary_blob_endpoint
   storage_account_access_key = azurerm_storage_account.example.primary_access_key
   disabled_alerts = [
     "Sql_Injection",
     "Data_Exfiltration"
   ]
   email_addresses = ["db-security@acme.org"]
 }