Homepage

Cloud SQL Instances is not Using Customer-Managed Encryption Keys Affecting Cloud SQL service in Google

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Data/ Encryption at Rest

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
  • Snyk IDSNYK-CC-00743
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Enforcing the use of customer-managed encryption keys (CMEK) for Cloud SQL instances ensures that data at rest is encrypted according to the organization's specific security and compliance requirements. Without CMEK, the default Google-managed keys are used, which may not comply with certain regulatory frameworks or enterprise security policies. This can lead to potential risks such as unauthorized data access or failure to meet compliance mandates.

How to fix?

Set the encryption_key_name attribute in google_sql_database_instance resource to a valid CMEK.

Example Configuration


resource "google_sql_database_instance" "allow1" {
  name             = "snyk-instance"
  database_version = "SQLSERVER_2017_STANDARD"
  region           = "us-central1"

  settings {
    tier = "db-custom-2-13312"
  }
  deletion_protection = false
  root_password       = "snyk743@"
  encryption_key_name = google_kms_crypto_key.key.id
  depends_on          = [google_kms_crypto_key_iam_binding.crypto_key-role]
}