Check ID:
Provider: GCP
Service:
Severity: MEDIUM
Categories:
Resource type:
cloudsql_instance_sqlserver_remote_access_flagProvider: GCP
Service:
cloudsqlSeverity: MEDIUM
Categories:
trust-boundariesResource type:
sqladmin.googleapis.com/InstanceWhat this check verifies
Cloud SQL for SQL Server instances where theremote access database flag is on, allowing remote procedure calls between servers
Risk
Enabling remote procedure calls expands exposure: untrusted servers can invoke stored procedures, leading to data exfiltration (confidentiality), unauthorized changes (integrity), and DoS via resource-heavy remote execution (availability). It can also enable lateral movement.Recommendation
Setremote access to off to reduce the attack surface. Apply least privilege and defense in depth: avoid remote stored procedures; if business-required, allow only trusted peers, enforce strong authentication, audit calls, and monitor for abuse.
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudSQL/disable-remote-access-flag.html
- https://cloud.google.com/sql/docs/sqlserver/flags
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = cloudsql_instance_sqlserver_remote_access_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks