Cloud SQL SQL Server: external scripts enabled = off

Check ID: cloudsql_instance_sqlserver_external_scripts_enabled_flag
Provider: GCP
Service: cloudsql
Severity: HIGH
Categories: vulnerabilities
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL for SQL Server instances have the external scripts enabled database flag set to off

Risk

Allowing external scripts lets SQL invoke language extensions (e.g., R/Python), enabling arbitrary code execution. This can cause data exfiltration (confidentiality), tampered query results (integrity), and resource exhaustion or service degradation (availability), and may facilitate lateral movement from the database layer.

Recommendation

Keep external scripts enabled set to off. Apply least privilege and defense in depth by disabling code-execution features in the database. If analytics are required, use isolated instances, restrict outbound network access, and enforce change control and auditing to prevent misuse.

Remediation

CLI
Terraform
Dashboard steps

gcloud sql instances patch <INSTANCE_NAME> --database-flags="external scripts enabled"=off

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<REGION>"
  database_version = "SQLSERVER_2019_STANDARD"

  settings {
    tier = "db-custom-2-7680"

    # Critical: disables external scripts on the SQL Server instance
    database_flags {
      name  = "external scripts enabled"  # sets the flag
      value = "off"                        # required value to pass the check
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_sqlserver_external_scripts_enabled_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL SQL Server: cross db ownership chaining = off Cloud SQL SQL Server: remote access = off

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires