Homepage

SSL is not enabled on CloudSQL instance Affecting Cloud SQL service in Google

Severity

0.0
high
0
10
Severity Framework
Snyk CCSS
Rule category
Data/ Encryption in Transit

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
CIS-ControlsCIS-GoogleCSA-CCMGDPRHIPAAISO-27001NIST-800-53PCI-DSSSOC-2
  • Snyk IDSNYK-CC-00365
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

SQL database instances supporting plaintext connections are susceptible to man-in-the-middle attacks that can reveal sensitive data like credentials, queries, and datasets. It is therefore recommended to always use SSL encryption for database connections.

How to fix?

For Google provider < v5.0.0, set the require_ssl attribute on settings.ip_configuration to true. For Google provider >= v5.0.0, set ssl_mode on settings.ip_configuration to one of ENCRYPTED_ONLY or TRUSTED_CLIENT_CERTIFICATE_REQUIRED.

Example configuration:

# < v5.0.0
resource "google_sql_database_instance" "allowed" {
  name             = "db-instance"
  database_version = "POSTGRES_11"
  region           = "us-central1"

  settings {
    tier = "db-f1-micro"
    ip_configuration {
      require_ssl = true
    }
  }
}


# >= v5.0.0
resource "google_sql_database_instance" "allowed" {
  name             = "db-instance"
  database_version = "POSTGRES_11"
  region           = "us-central1"

  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ssl_mode = "ENCRYPTED_ONLY"
    }
  }
}