Cloud SQL database instance has no public IP address

Check ID: cloudsql_instance_public_ip
Provider: GCP
Service: cloudsql
Severity: HIGH
Categories: internet-exposed
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL instances are evaluated for exposure via public IP addresses instead of private IP connectivity within a VPC. Instances with an externally routable database endpoint are surfaced.

Risk

Public DB endpoints expand attack surface:

Credential brute force and SQL injection threaten confidentiality and integrity
Internet DDoS reduces availability
Exposure bypasses VPC controls, easing lateral movement and data exfiltration

Recommendation

Prefer private IP and disable public endpoints. Access databases over VPC, VPN/Interconnect, or Private Service Connect. If authorized networks are required, restrict to specific sources-never 0.0.0.0/0. Enforce least privilege IAM, use Cloud SQL connectors/proxy, and layer defense in depth with network controls and monitoring.

Remediation

CLI
Terraform
Dashboard steps

gcloud beta sql instances patch <example_resource_id> --project=<example_resource_id> --network=projects/<example_resource_id>/global/networks/<example_resource_name> --no-assign-ip

# Cloud SQL instance without public IP
resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<REGION>"
  database_version = "MYSQL_8_0"

  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ipv4_enabled   = false  # Critical: disables public (IPv4) IP
      private_network = "projects/<example_project_id>/global/networks/<example_resource_name>"  # Critical: ensures private IP via specified VPC
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_public_ip. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL instance blocks 0.0.0.0/0 in authorized networks Cloud SQL SQL Server: contained db authentication = off

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires