TMA-GCP-CLOUDSQL-REQUIRE-SSL

Ensure Cloud SQL instances require all incoming connections to use SSL

ÉlevéeNiveau 1Automatiséegcp

Description

Without enforced TLS, database credentials and data can cross the network unencrypted. Every instance must have requireSsl true or sslMode ENCRYPTED_ONLY / TRUSTED_CLIENT_CERTIFICATE_REQUIRED. Read-only gcloud calls against the active project (gcloud config set project, or CLOUDSDK_CORE_PROJECT); credentials come from the SDK's normal configuration (gcloud auth login, a service account or ADC). A missing CLI, credential or disabled API fails the check.

Méthode de vérification

Méthode d'audit: Commande shell

shell

out=$(gcloud sql instances list --format='value(name,settings.ipConfiguration.requireSsl,settings.ipConfiguration.sslMode)' 2>/dev/null) || exit 1
printf '%s\n' "$out" | awk -F '\t' 'NF && $2 != "True" && $3 != "ENCRYPTED_ONLY" && $3 != "TRUSTED_CLIENT_CERTIFICATE_REQUIRED" { n++; print "SSL not required: " $1 } END { if (!n) print "compliant" }'

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

gcloud sql instances patch <instance> --ssl-mode=ENCRYPTED_ONLY (or TRUSTED_CLIENT_CERTIFICATE_REQUIRED). Update clients to connect with TLS or via the Cloud SQL Auth Proxy first.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: gcpdatabase
Référence: CIS Google Cloud Platform Foundation Benchmark v5.0.0 - Cloud SQL - require SSL/TLS for incoming connections (verify section number for your release)

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target gcp