Cloud SQL SQL Server: contained db authentication = off

Check ID: cloudsql_instance_sqlserver_contained_database_authentication_flag
Provider: GCP
Service: cloudsql
Severity: MEDIUM
Categories: identity-access
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL for SQL Server instances are evaluated for the contained database authentication setting. The check inspects the contained database authentication flag and expects its value to be off.

Risk

Enabling contained authentication moves identity checks to the database, bypassing server-level logins and policies. This weakens centralized controls and auditing, enables password spraying on contained users, and can persist users across copies, increasing unauthorized data access and tampering risk to confidentiality and integrity.

Recommendation

Keep contained database authentication set to off. Centralize authentication and auditing at the server layer or via directory integration, and apply least privilege. Avoid USER WITH PASSWORD contained users. If containment is unavoidable, tightly scope usage, enforce strong credentials, and monitor login activity.

Remediation

CLI
Terraform
Dashboard steps

gcloud sql instances patch <INSTANCE_NAME> --database-flags="contained database authentication"=off

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<REGION>"
  database_version = "SQLSERVER_2019_STANDARD"

  settings {
    tier = "<TIER>"
    database_flags {
      name  = "contained database authentication" # critical: target flag
      value = "off"                                # critical: disable contained DB auth
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_sqlserver_contained_database_authentication_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL database instance has no public IP address Cloud SQL SQL Server: cross db ownership chaining = off

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires