Homepage

Cloud IAM not configured for CloudSQL instance Affecting Cloud SQL service in Google

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Data/ Access

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
CIS-ControlsSOC-2
  • Snyk IDSNYK-CC-00355
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Dismissing Cloud IAM makes access control management more difficult and error-prone.

How to fix?

Configure a settings.database_flags block according to the following table.

Database engine Flag Name Flag Value
MySQL cloudsql_iam_authentication On
PostgreSQL cloudsql.iam_authentication On
SQL Server N/A N/A

Example Configuration

resource "google_sql_database_instance" "allowed" {
  name             = "allowed-instance"
  database_version = "MYSQL_8_0"
  region           = "us-central1"

  settings {
    tier = "db-f1-micro"

    database_flags {
      name = "cloudsql_iam_authentication"
      value = "On"
    }

    database_flags {
      name = "performance_schema"
      value = "Off"
    }
  }
}

OR

resource "google_sql_database_instance" "allowed" {
  name             = "allowed-instance"
  database_version = "POSTGRES_11"
  region           = "us-central1"

  settings {
    tier = "db-f1-micro"

    database_flags {
      name = "cloudsql.iam_authentication"
      value = "On"
    }
  }
}