Cloud SQL MySQL: skip_show_database = on

Check ID: cloudsql_instance_mysql_skip_show_database_flag
Provider: GCP
Service: cloudsql
Severity: LOW
Categories: identity-access
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL MySQL instances configure the skip_show_database database flag to on, limiting use of SHOW DATABASES to accounts with the SHOW DATABASES privilege.

Risk

Without skip_show_database set to on, database names can be exposed to unprivileged users, reducing confidentiality. Attackers can perform schema enumeration and targeted probing, enabling lateral movement and privilege escalation against specific datasets.

Recommendation

Set skip_show_database to on for all Cloud SQL MySQL instances. Enforce least privilege by granting SHOW DATABASES only when necessary and reviewing roles regularly. Use defense in depth: monitor access and admin actions, and plan changes in maintenance windows as flag updates may trigger restarts.

Remediation

CLI
Terraform
Dashboard steps

gcloud sql instances patch <INSTANCE_NAME> --database-flags=skip_show_database=on

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  database_version = "MYSQL_8_0"
  region           = "<example_region>"

  settings {
    tier = "db-custom-1-3840"

    database_flags {
      name  = "skip_show_database"   # Critical: enforce hiding databases from users without SHOW DATABASES privilege
      value = "on"                   # Critical: set flag to 'on' to pass the check
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_mysql_skip_show_database_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL MySQL: local_infile = off Cloud SQL PostgreSQL: cloudsql.enable_pgaudit = on

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires