Cloud SQL instance is publicly accessible Affecting Cloud SQL service in Google


Severity

0.0
medium
0
10
    Severity Framework
    Snyk CCSS
    Rule category
    Network / Public Access

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
    CIS-Controls CIS-Google CSA-CCM NIST-800-53 PCI-DSS SOC-2
  • Snyk ID SNYK-CC-00359
  • credit Snyk Research Team

Description

SQL database instances permitting access from 0.0.0.0/0 allow access from anywhere in the world. To minimize its attack surface, a database server should only permit connections from trusted IP addresses.

How to fix?

Set settings.ip_configuration.authorized_networks attribute to specific value, e.g. 192.168.0.0/24.

Example Configuration

resource "google_sql_database_instance" "allowed" {
  name             = "master-instance"
  database_version = "POSTGRES_11"
  region           = "us-central1"
  settings {
    tier = "db-f1-micro"
    ip_configuration {
      authorized_networks {
        value = "192.168.0.0/24"
      }
    }
  }
}