Ensure Cloud SQL instances require all incoming connections to use SSL

HighLevel 1Automatedgcp

Description

Without enforced TLS, database credentials and data can cross the network unencrypted. Every instance must have requireSsl true or sslMode ENCRYPTED_ONLY / TRUSTED_CLIENT_CERTIFICATE_REQUIRED. Read-only gcloud calls against the active project (gcloud config set project, or CLOUDSDK_CORE_PROJECT); credentials come from the SDK's normal configuration (gcloud auth login, a service account or ADC). A missing CLI, credential or disabled API fails the check.

How it is checked

Audit method: Shell command

shell

out=$(gcloud sql instances list --format='value(name,settings.ipConfiguration.requireSsl,settings.ipConfiguration.sslMode)' 2>/dev/null) || exit 1
printf '%s\n' "$out" | awk -F '\t' 'NF && $2 != "True" && $3 != "ENCRYPTED_ONLY" && $3 != "TRUSTED_CLIENT_CERTIFICATE_REQUIRED" { n++; print "SSL not required: " $1 } END { if (!n) print "compliant" }'

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

gcloud sql instances patch <instance> --ssl-mode=ENCRYPTED_ONLY (or TRUSTED_CLIENT_CERTIFICATE_REQUIRED). Update clients to connect with TLS or via the Cloud SQL Auth Proxy first.

Properties

Operating systems: Any
Tags: gcpdatabase
Reference: CIS Google Cloud Platform Foundation Benchmark v5.0.0 - Cloud SQL - require SSL/TLS for incoming connections (verify section number for your release)

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target gcp