Cloud SQL instance blocks 0.0.0.0/0 in authorized networks

Check ID: cloudsql_instance_public_access
Provider: GCP
Service: cloudsql
Severity: CRITICAL
Categories: internet-exposed
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL authorized networks are checked for the open CIDR 0.0.0.0/0 on instances using a public IP. The finding flags configurations where a catch-all entry exists instead of specific client ranges.

Risk

Allowing 0.0.0.0/0 makes the database reachable from the Internet, degrading confidentiality and availability. Attackers can brute-force credentials, probe for vulnerable endpoints, exfiltrate data via unauthorized queries, and trigger resource exhaustion through automated scanning.

Recommendation

Enforce least privilege network access:

Remove 0.0.0.0/0; allow only trusted, fixed IP ranges
Prefer private IP or Private Service Connect with VPC controls
Use proxied access (Cloud SQL Auth Proxy) over direct public connections
Apply org policies to prevent broad allowlists

Remediation

CLI
Terraform
Dashboard steps

gcloud sql instances patch <INSTANCE_NAME> --authorized-networks=""

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  database_version = "<DATABASE_VERSION>"

  settings {
    tier = "<TIER>"

    ip_configuration {
      authorized_networks {
        value = "<ALLOWED_CIDR>" # Critical: remove 0.0.0.0/0; allow only specific CIDR to pass the check
      }
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_public_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL instance has no public IP addresses Cloud SQL database instance has no public IP address

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires