Explanation
When Auditing is configured for a SQL database, if the retention period is not set, the retention will be unlimited.
If the retention period is to be explicitly set, it should be set for no less than 90 days.
Insecure Example
The following example will fail the AZU019 check.
resource "azurerm_mssql_database_extended_auditing_policy" "bad_example" {
database_id = azurerm_mssql_database.example.id
storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint
storage_account_access_key = azurerm_storage_account.example.primary_access_key
storage_account_access_key_is_secondary = false
retention_in_days = 6
}Secure Example
The following example will pass the AZU019 check.
resource "azurerm_mssql_database_extended_auditing_policy" "good_example" {
database_id = azurerm_mssql_database.example.id
storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint
storage_account_access_key = azurerm_storage_account.example.primary_access_key
storage_account_access_key_is_secondary = false
}
resource "azurerm_mssql_database_extended_auditing_policy" "good_example" {
database_id = azurerm_mssql_database.example.id
storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint
storage_account_access_key = azurerm_storage_account.example.primary_access_key
storage_account_access_key_is_secondary = false
retention_in_days = 90
}