feat(azure): add mysql_flexible_server_high_availability_enabled check (#11042)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
2026-07-04 19:21:51 +00:00 · 2026-06-19 16:00:46 +09:00
parent 99285d4656
commit d961d7efe4
7 changed files with 243 additions and 1 deletions
@@ -21,6 +21,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `databricks_workspace_no_public_ip_enabled` check for Azure provider, verifying Databricks workspaces use secure cluster connectivity (no public IP) so compute nodes are not assigned public IP addresses [(#11036)](https://github.com/prowler-cloud/prowler/pull/11036)
 - `defender_ensure_defender_cspm_is_on` check for Azure provider, verifying Microsoft Defender Cloud Security Posture Management (CSPM) is enabled on the Standard tier [(#11037)](https://github.com/prowler-cloud/prowler/pull/11037)
 - `mysql_flexible_server_geo_redundant_backup_enabled` check for Azure provider, verifying MySQL Flexible Servers have geo-redundant backup enabled so backups are replicated to the paired region [(#11041)](https://github.com/prowler-cloud/prowler/pull/11041)
+- `mysql_flexible_server_high_availability_enabled` check for Azure provider, verifying MySQL Flexible Servers have high availability enabled for automatic failover to a standby replica [(#11042)](https://github.com/prowler-cloud/prowler/pull/11042)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
@@ -1298,7 +1298,8 @@
        "vm_ensure_using_managed_disks",
        "vm_trusted_launch_enabled",
        "cosmosdb_account_automatic_failover_enabled",
-        "mysql_flexible_server_geo_redundant_backup_enabled"
+        "mysql_flexible_server_geo_redundant_backup_enabled",
+        "mysql_flexible_server_high_availability_enabled"
      ]
    },
    {
@@ -0,0 +1,37 @@
+{
+  "Provider": "azure",
+  "CheckID": "mysql_flexible_server_high_availability_enabled",
+  "CheckTitle": "MySQL flexible server has high availability enabled",
+  "CheckType": [],
+  "ServiceName": "mysql",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.dbformysql/flexibleservers",
+  "ResourceGroup": "database",
+  "Description": "**Azure MySQL Flexible Server** is evaluated for **high availability** mode. Zone-redundant or same-zone HA provisions a standby replica and provides automatic failover during planned and unplanned outages.",
+  "Risk": "Without **high availability**, a server or zone failure causes **downtime** until manual recovery or redeployment. Applications experience extended unavailability and potential data loss for in-flight transactions during unplanned outages.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-high-availability",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.dbformysql/flexibleservers"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az mysql flexible-server update --name <server_name> --resource-group <resource_group_name> --high-availability ZoneRedundant",
+      "NativeIaC": "```bicep\n// Bicep: MySQL Flexible Server with zone-redundant high availability\nresource mysql 'Microsoft.DBforMySQL/flexibleServers@2023-12-30' = {\n  name: '<example_resource_name>'\n  location: '<region>'\n  sku: {\n    name: 'Standard_D2ds_v4'\n    tier: 'GeneralPurpose'\n  }\n  properties: {\n    highAvailability: {\n      mode: 'ZoneRedundant' // CRITICAL: provisions a standby replica with automatic failover\n    }\n  }\n}\n```",
+      "Other": "1. In the Azure portal, open your Azure Database for MySQL flexible server\n2. Under Settings, select High availability\n3. Enable High availability and choose Zone redundant (or Same zone)\n4. Save (high availability requires the General Purpose or Business Critical tier)",
+      "Terraform": "```hcl\n# Terraform: MySQL Flexible Server with zone-redundant high availability\nresource \"azurerm_mysql_flexible_server\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<region>\"\n  sku_name            = \"GP_Standard_D2ds_v4\"\n\n  high_availability {\n    mode = \"ZoneRedundant\" # CRITICAL: provisions a standby replica with automatic failover\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **high availability** (zone-redundant where supported, otherwise same-zone) on production MySQL Flexible Servers so a standby replica provides automatic failover. High availability requires the General Purpose or Business Critical tier; pair it with geo-redundant backup and periodic failover testing for full resilience.",
+      "Url": "https://hub.prowler.com/check/mysql_flexible_server_high_availability_enabled"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "High availability for Azure MySQL Flexible Server requires the General Purpose or Business Critical compute tier and is not available on the Burstable tier."
+}
@@ -0,0 +1,34 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.mysql.mysql_client import mysql_client
+
+
+class mysql_flexible_server_high_availability_enabled(Check):
+    """
+    Ensure Azure MySQL Flexible Servers have high availability enabled.
+
+    This check evaluates whether each Azure MySQL Flexible Server is configured with high availability (zone-redundant or same-zone), providing automatic failover to a standby replica during outages.
+
+    - PASS: The server has high availability enabled (high_availability_mode is set and not "Disabled").
+    - FAIL: The server does not have high availability enabled.
+    """
+
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+        for subscription_id, servers in mysql_client.flexible_servers.items():
+            subscription_name = mysql_client.subscriptions.get(
+                subscription_id, subscription_id
+            )
+            for server in servers.values():
+                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
+                report.subscription = subscription_id
+                if (
+                    server.high_availability_mode is not None
+                    and server.high_availability_mode != "Disabled"
+                ):
+                    report.status = "PASS"
+                    report.status_extended = f"High availability is enabled for server {server.name} in subscription {subscription_name} ({subscription_id})."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"High availability is disabled for server {server.name} in subscription {subscription_name} ({subscription_id})."
+                findings.append(report)
+        return findings
@@ -23,6 +23,7 @@ class MySQL(AzureService):
                servers.update({subscription_id: {}})
                for server in servers_list:
                    backup = getattr(server, "backup", None)
+                    ha = getattr(server, "high_availability", None)
                    servers[subscription_id].update(
                        {
                            server.id: FlexibleServer(
@@ -36,6 +37,7 @@ class MySQL(AzureService):
                                geo_redundant_backup=getattr(
                                    backup, "geo_redundant_backup", None
                                ),
+                                high_availability_mode=getattr(ha, "mode", None),
                            )
                        }
                    )
@@ -84,3 +86,4 @@ class FlexibleServer:
    version: str
    configurations: dict[Configuration]
    geo_redundant_backup: Optional[str] = None
+    high_availability_mode: Optional[str] = None
@@ -0,0 +1,166 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.azure.services.mysql.mysql_service import FlexibleServer
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_DISPLAY,
+    AZURE_SUBSCRIPTION_ID,
+    AZURE_SUBSCRIPTION_NAME,
+    set_mocked_azure_provider,
+)
+
+
+class Test_mysql_flexible_server_high_availability_enabled:
+    def test_mysql_no_subscriptions(self):
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled import (
+                mysql_flexible_server_high_availability_enabled,
+            )
+
+            check = mysql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_mysql_high_availability_disabled(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: {
+                server_id: FlexibleServer(
+                    resource_id=server_id,
+                    name=server_name,
+                    location="eastus",
+                    version="8.0",
+                    configurations={},
+                    high_availability_mode="Disabled",
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled import (
+                mysql_flexible_server_high_availability_enabled,
+            )
+
+            check = mysql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"High availability is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == server_name
+            assert result[0].resource_id == server_id
+            assert result[0].location == "eastus"
+
+    def test_mysql_high_availability_not_set(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: {
+                server_id: FlexibleServer(
+                    resource_id=server_id,
+                    name=server_name,
+                    location="eastus",
+                    version="8.0",
+                    configurations={},
+                    high_availability_mode=None,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled import (
+                mysql_flexible_server_high_availability_enabled,
+            )
+
+            check = mysql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"High availability is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
+            )
+
+    def test_mysql_high_availability_enabled(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: {
+                server_id: FlexibleServer(
+                    resource_id=server_id,
+                    name=server_name,
+                    location="eastus",
+                    version="8.0",
+                    configurations={},
+                    high_availability_mode="ZoneRedundant",
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled import (
+                mysql_flexible_server_high_availability_enabled,
+            )
+
+            check = mysql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"High availability is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == server_name
+            assert result[0].resource_id == server_id
+            assert result[0].location == "eastus"