Check ID:
Provider: GCP
Service:
Severity: HIGH
Categories:
Resource type:
cloudsql_instance_private_ip_assignmentProvider: GCP
Service:
cloudsqlSeverity: HIGH
Categories:
internet-exposedResource type:
sqladmin.googleapis.com/InstanceWhat this check verifies
Cloud SQL instances are evaluated for IP assignment, highlighting instances that have any public IP instead of being restricted to private IP only.Risk
Public database endpoints expose services to Internet scanning, brute-force logins, and exploit attempts. A compromise can cause data exfiltration (confidentiality), unauthorized changes (integrity), and outages or DDoS impact (availability), while bypassing VPC isolation and enabling lateral movement.Recommendation
Use private IP-only connectivity for databases. Remove public IPs, segment access to required VPCs/subnets, and enforce least privilege with strong auth and TLS. For external access, use secure private channels (VPN/Interconnect) or a hardened bastion. Monitor connections as part of defense in depth.Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://cloud.google.com/sql/docs/mysql/configure-private-ip
- https://docs.cloud.google.com/sql/docs/sqlserver/recommender-disable-public-ip
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = cloudsql_instance_private_ip_assignment. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks