Homepage
About Snyk

Cloud SQL Instances is not Using Customer-Managed Encryption Keys Affecting Cloud SQL service in Google

0.0
medium
    Severity Framework Snyk CCSS
    Rule category Data / Encryption at Rest

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
  • Snyk ID SNYK-CC-00743
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

Enforcing the use of customer-managed encryption keys (CMEK) for Cloud SQL instances ensures that data at rest is encrypted according to the organization's specific security and compliance requirements. Without CMEK, the default Google-managed keys are used, which may not comply with certain regulatory frameworks or enterprise security policies. This can lead to potential risks such as unauthorized data access or failure to meet compliance mandates.

How to fix?

Set the encryption_key_name attribute in google_sql_database_instance resource to a valid CMEK.

Example Configuration


resource "google_sql_database_instance" "allow1" {
  name             = "snyk-instance"
  database_version = "SQLSERVER_2017_STANDARD"
  region           = "us-central1"

  settings {
    tier = "db-custom-2-13312"
  }
  deletion_protection = false
  root_password       = "snyk743@"
  encryption_key_name = google_kms_crypto_key.key.id
  depends_on          = [google_kms_crypto_key_iam_binding.crypto_key-role]
}