Ensure Cloud SQL instances require all incoming connections to use SSL

높음레벨 1자동gcp

설명

Without enforced TLS, database credentials and data can cross the network unencrypted. Every instance must have requireSsl true or sslMode ENCRYPTED_ONLY / TRUSTED_CLIENT_CERTIFICATE_REQUIRED. Read-only gcloud calls against the active project (gcloud config set project, or CLOUDSDK_CORE_PROJECT); credentials come from the SDK's normal configuration (gcloud auth login, a service account or ADC). A missing CLI, credential or disabled API fails the check.

점검 방법

감사 방식: 셸 명령

shell

out=$(gcloud sql instances list --format='value(name,settings.ipConfiguration.requireSsl,settings.ipConfiguration.sslMode)' 2>/dev/null) || exit 1
printf '%s\n' "$out" | awk -F '\t' 'NF && $2 != "True" && $3 != "ENCRYPTED_ONLY" && $3 != "TRUSTED_CLIENT_CERTIFICATE_REQUIRED" { n++; print "SSL not required: " $1 } END { if (!n) print "compliant" }'

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

gcloud sql instances patch <instance> --ssl-mode=ENCRYPTED_ONLY (or TRUSTED_CLIENT_CERTIFICATE_REQUIRED). Update clients to connect with TLS or via the Cloud SQL Auth Proxy first.

속성

운영 체제: 모두
태그: gcpdatabase
참고 자료: CIS Google Cloud Platform Foundation Benchmark v5.0.0 - Cloud SQL - require SSL/TLS for incoming connections (verify section number for your release)

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target gcp