Microsoft AzureOverview
Redis often stores sensitive session and cache data. Non-SSL access and weak TLS versions increase interception risk.
Remediation guidance
Azure Remediation
Service-Wide (Recommended)
Enforce TLS and secure Redis baseline through Azure Policy and landing-zone standards.
Azure Portal (Asset-Level)
- Open Redis cache instance.
- Disable non-SSL port.
- Set minimum TLS version to 1.2 or higher.
Azure CLI (Asset-Level)
az redis update --name <redis-name> --resource-group <resource-group> --set enableNonSslPort=false minimumTlsVersion=1.2
References
- https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-configure
Query logic
These are the stored checks tied to this control.
Redis instances with insecure transport settings
Connectors
Microsoft Azure
Covered asset types
RedisInstance
Expected check: eq []
{ redisInstances(where: { OR: [ { enableNonSslPort: true }, { minimumTlsVersion_IN: ["1.0", "1.1"] } ] }) { ...AssetFragment } }
