Ensure Cloud SQL instances require all incoming connections to use SSL

高级别 1自动化gcp

说明

Without enforced TLS, database credentials and data can cross the network unencrypted. Every instance must have requireSsl true or sslMode ENCRYPTED_ONLY / TRUSTED_CLIENT_CERTIFICATE_REQUIRED. Read-only gcloud calls against the active project (gcloud config set project, or CLOUDSDK_CORE_PROJECT); credentials come from the SDK's normal configuration (gcloud auth login, a service account or ADC). A missing CLI, credential or disabled API fails the check.

检查方式

审计方法: Shell 命令

shell

out=$(gcloud sql instances list --format='value(name,settings.ipConfiguration.requireSsl,settings.ipConfiguration.sslMode)' 2>/dev/null) || exit 1
printf '%s\n' "$out" | awk -F '\t' 'NF && $2 != "True" && $3 != "ENCRYPTED_ONLY" && $3 != "TRUSTED_CLIENT_CERTIFICATE_REQUIRED" { n++; print "SSL not required: " $1 } END { if (!n) print "compliant" }'

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

gcloud sql instances patch <instance> --ssl-mode=ENCRYPTED_ONLY (or TRUSTED_CLIENT_CERTIFICATE_REQUIRED). Update clients to connect with TLS or via the Cloud SQL Auth Proxy first.

属性

操作系统: 任意
标签: gcpdatabase
参考: CIS Google Cloud Platform Foundation Benchmark v5.0.0 - Cloud SQL - require SSL/TLS for incoming connections (verify section number for your release)

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target gcp