Google CloudOverview
Database Server should accept connections only from trusted network(s)/IP(s) and restrict access from public IP addresses.
Rationale
To minimize attack surface on a Database server instance, only trusted/known and required IP(s) should be white-listed to connect to it.
An authorized network should not have IPs/networks configured to 0.0.0.0/0 which will allow access to the instance from anywhere in the world. Note that authorized networks apply only to instances with public IPs.
Impact
The Cloud SQL database instance would not be available to public IP addresses.
Remediation guidance
Google Cloud Remediation
Service-wide fix (recommended): remove direct public database access wherever possible and enforce
constraints/sql.restrictAuthorizedNetworksso teams cannot reintroduce broad authorized networks later.
Google Cloud console
- Open
Cloud SQL Instances. - Select the instance.
- Go to
Connections->Networking. - Remove any authorized network entry set to
0.0.0.0/0. - Save the change.
Google Cloud CLI
Replace the authorized networks list with only approved ranges:
gcloud sql instances patch <instance-name> --authorized-networks=<cidr-1>,<cidr-2>
Validate the configured authorized networks:
gcloud sql instances describe <instance-name>
Prevention
Enforce the predefined organization policy that restricts authorized networks on Cloud SQL:
name: organizations/<org-id>/policies/sql.restrictAuthorizedNetworks
spec:
rules:
- enforce: true
gcloud org-policies set-policy policy.yaml
Operational notes
- Authorized networks apply only to instances that expose a public IP path. If you can move to private IP or proxied connections, that is usually a better fix.
- The
sql.restrictAuthorizedNetworksconstraint is not retroactive. Existing broad entries keep working until you remove them. gcloud sql connecttemporarily updates authorized networks and can conflict with these policies. Google recommendsgcloud beta sql connectwhen connection organization policies are enforced.
References
- https://cloud.google.com/sql/docs/postgres/authorize-networks
- https://docs.cloud.google.com/sql/docs/postgres/connection-org-policy
- https://docs.cloud.google.com/sql/docs/sqlserver/org-policy/configure-org-policy
- https://docs.cloud.google.com/sdk/gcloud/reference/sql/connect
Query logic
These are the stored checks tied to this control.
Google Cloud Cloud SQL
Connectors
Covered asset types
Expected check: eq []
{
cloudSqlInstances(
where: {
cloudProvider: "gcp"
networkSettings_SOME: {
authorizedNetworks_SOME: {
OR: [{ cidrValue: "0.0.0.0/0" }, { cidrValue: "::/0" }]
}
}
}
) {
...AssetFragment
}
}
