STIGQter STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must restrict execution of stored procedures and functions that utilize [execute as] to necessary cases only.

DISA Rule

SV-255317r961359_rule

Vulnerability Number

V-255317

Group Title

SRG-APP-000342-DB-000302

Rule Version

ASQL-00-002900

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Alter stored procedures and functions to remove the "EXECUTE AS" statement.

Check Contents

Review the system documentation to obtain a listing of stored procedures and functions that utilize impersonation. Execute the following query:

SELECT S.name AS schema_name, O.name AS module_name,
USER_NAME(CASE M.execute_as_principal_id
WHEN -2 THEN COALESCE(O.principal_id, S.principal_id)
ELSE M.execute_as_principal_id
END) AS execute_as
FROM sys.sql_modules M
JOIN sys.objects O ON M.object_id = O.object_id
JOIN sys.schemas S ON O.schema_id = S.schema_id
WHERE execute_as_principal_id IS NOT NULL
ORDER BY schema_name, module_name

If any procedures or functions are returned that are not documented, this is a finding.

Vulnerability Number

V-255317

Documentable

False

Rule Version

ASQL-00-002900

Severity Override Guidance

Review the system documentation to obtain a listing of stored procedures and functions that utilize impersonation. Execute the following query:

SELECT S.name AS schema_name, O.name AS module_name,
USER_NAME(CASE M.execute_as_principal_id
WHEN -2 THEN COALESCE(O.principal_id, S.principal_id)
ELSE M.execute_as_principal_id
END) AS execute_as
FROM sys.sql_modules M
JOIN sys.objects O ON M.object_id = O.object_id
JOIN sys.schemas S ON O.schema_id = S.schema_id
WHERE execute_as_principal_id IS NOT NULL
ORDER BY schema_name, module_name

If any procedures or functions are returned that are not documented, this is a finding.

Check Content Reference

M

Target Key

5500