#7670·checkov

CKV_AZURE_27 false positive for azurerm_mssql_server_security_alert_policy with AzureRM provider v5.3.0

Author: satz-bCreated Sep 4, 2026Updated Sep 4, 2026

Labelschecks

Describe the issue

CKV_AZURE_27 reports a failure for an azurerm_mssql_server_security_alert_policy resource even though:

state is set to "Enabled"
email_account_admins_enabled resolves to true

The problem started after upgrading the AzureRM provider to version 5.3.0.

The same result is reproducible with the latest available Checkov version. (3.3.16)

Check being reported

CKV_AZURE_27 - Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers

Examples

The resource is declared in a module called mssql_server

hcl

resource "azurerm_mssql_server_security_alert_policy" "mssql_alert_policy_replica" {

  resource_group_name = "example-resource-group"
  server_name         = azurerm_mssql_server.sql_server.name
  state               = "Enabled"
  email_addresses     = var.owner_emails
  email_account_admins_enabled = var.admin_alerts
  retention_days = 7
}

The module is called with var.admin_alerts set to true like this

hcl


module "mssql_server" {
  source = "../.modules/mssql-server"

  ...........
  sql_security_alerts_recipients = var.owner_emails
  admin_alerts                   = true
  alerts_enabled                 = var.alerts_enabled
  .......
}

Expected behavior CKV_AZURE_27 should pass because the MSSQL server security alert policy is enabled and email notifications to subscription administrators are explicitly enabled.

Actual behavior Checkov reports CKV_AZURE_27 as failed for the resource.

Steps to reproduce

Configure an azurerm_mssql_server_security_alert_policy inside a Terraform module.
Assign a module input variable to email_account_admins_enabled.
Pass the literal boolean value true to that module input.
Use AzureRM provider version 5.3.0.
Run Checkov against the Terraform configuration.
Observe that CKV_AZURE_27 fails.

Version (please complete the following information):

Checkov Version [e.g. 22]: 3.3.16

Additional context

Minimal reproduction

main.tf

hcl

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "5.3.0"
    }
  }
}

module "mssql_server" {
  source = "./modules/mssql-server"

  resource_group_name = "example-resource-group"
  server_name         = "example-sql-server"
  admin_alerts        = true
}

modules/mssql-server/variables.tf

hcl

variable "resource_group_name" {
  type = string
}

variable "server_name" {
  type = string
}

variable "admin_alerts" {
  type = bool
}

modules/mssql-server/main.tf

hcl

resource "azurerm_mssql_server_security_alert_policy" "example" {
  resource_group_name = var.resource_group_name
  server_name         = var.server_name

  state                        = "Enabled"
  email_account_admins_enabled = var.admin_alerts
  retention_days               = 7
}

This was working fine before the AzureRM provider version update.

Source: bridgecrewio/checkov

View original on GitHub View discussion on GitHub