Check ID:
Provider: GCP
Service:
Severity: HIGH
Categories:
Resource type:
cloudsql_instance_mysql_local_infile_flagProvider: GCP
Service:
cloudsqlSeverity: HIGH
Categories:
vulnerabilitiesResource type:
sqladmin.googleapis.com/InstanceWhat this check verifies
Cloud SQL for MySQL instances are evaluated for thelocal_infile database flag being explicitly set to off, disabling use of LOAD DATA LOCAL.
Instances where local_infile is absent or not off are identified.
Risk
Withlocal_infile enabled, clients can send local files via LOAD DATA LOCAL. A stolen credential or SQL injection can coerce clients to leak files and mass-ingest unvetted data, compromising confidentiality and integrity, and aiding lateral movement through secrets imported into the database.
Recommendation
Keeplocal_infile set to off. Use governed import channels (e.g., controlled object storage imports) and enforce least privilege for bulk-loading. Apply separation of duties between ingestion and admin roles, validate file sources and formats, and monitor high-volume loads. If ever needed, enable only briefly for vetted tasks.
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudSQL/disable-local-infile-flag.html
- https://cloud.google.com/sql/docs/mysql/flags
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = cloudsql_instance_mysql_local_infile_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks