Ensure the Cloud SQL database instances require all incoming connections to use SSL

From Google Cloud Console

1. Go to https://console.cloud.google.com/sql/instances
2. Click on an instance name to see its configuration overview
3. In the left-side panel, select Connections, then select the Security tab
4. In the SSL connections section, click Allow only SSL connections
5. Under Configure SSL server certificates click Create new certificate
6. Under Configure SSL client certificates click Create a client certificate
7. Follow the instructions shown to learn how to connect to your instance

From Google Cloud CLI

To enforce SSL encryption for an instance run the command:

gcloud sql instances patch <instanceName> --require-ssl

Note

RESTART is required for type MySQL Generation 1 Instances (backendType: FIRST_GEN) to get this configuration in effect.

Default Value

By default parameter settings: ipConfiguration: requireSsl is not set which is equivalent to requireSsl:false.

References

1. https://cloud.google.com/sql/docs/postgres/configure-ssl-instance/

Additional Information

By default Settings: ipConfiguration has no authorizedNetworks set/configured. In that case even if by default requireSsl is not set, which is equivalent to requireSsl:false there is no risk as instance cannot be accessed outside of the network unless authorizedNetworks are configured. However, If default for requireSsl is not updated to true any authorizedNetworks created later on will not enforce SSL only connection.

Multiple Remediation Paths

Google Cloud

SERVICE-WIDE (RECOMMENDED when many resources are affected): Enforce Organization Policies at org/folder level so new resources inherit secure defaults.

gcloud org-policies set-policy policy.yaml

ASSET-LEVEL: Use the product-specific remediation steps above for only the impacted project/resources.

PREVENTIVE: Use org policy constraints/custom constraints and enforce checks in deployment pipelines.

References for Service-Wide Patterns

• GCP Organization Policy overview: https://cloud.google.com/resource-manager/docs/organization-policy/overview
• GCP Organization policy constraints catalog: https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
• gcloud org-policies: https://cloud.google.com/sdk/gcloud/reference/org-policies

Operational Rollout Workflow

Use this sequence to reduce risk and avoid repeated drift.

1. Contain at Service-Wide Scope First (Recommended)

• Google Cloud: apply organization policy constraints at org/folder scope.

gcloud org-policies set-policy policy.yaml

2. Remediate Existing Affected Assets

• Execute the control-specific Console/CLI steps documented above for each flagged resource.
• Prioritize internet-exposed and production assets first.

3. Validate and Prevent Recurrence

• Re-scan after each remediation batch.
• Track exceptions with owner and expiry date.
• Add preventive checks in IaC/CI pipelines.