Homepage

Public IP is assigned to SQL database instance Affecting Cloud SQL service in Google

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Network/ Public Access

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
CIS-ControlsCIS-GoogleCSA-CCMISO-27001NIST-800-53SOC-2
  • Snyk IDSNYK-CC-00366
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

SQL database instances with public IP addresses may be directly accessible by hosts on the internet if configured incorrectly. To minimize its attack surface, a database server should be configured with private IP addresses. Private addresses provide better security because of intermediary firewall or NAT devices.

How to fix?

Set settings.ip_configuration.ipv4_enabled attribute to false.

Example Configuration

resource "google_sql_database_instance" "allowed_2" {
  name             = "db-instance"
  database_version = "POSTGRES_11"
  region           = "us-central1"
  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ipv4_enabled = false
      private_network = google_compute_network.private_network.id
    }
  }
}