Check ID: cloudsql_instance_sqlserver_remote_access_flag
Provider: GCP
Service: cloudsql
Severity: MEDIUM
Categories: trust-boundaries
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL for SQL Server instances where the remote access database flag is on, allowing remote procedure calls between servers

Risk

Enabling remote procedure calls expands exposure: untrusted servers can invoke stored procedures, leading to data exfiltration (confidentiality), unauthorized changes (integrity), and DoS via resource-heavy remote execution (availability). It can also enable lateral movement.

Recommendation

Set remote access to off to reduce the attack surface. Apply least privilege and defense in depth: avoid remote stored procedures; if business-required, allow only trusted peers, enforce strong authentication, audit calls, and monitor for abuse.

Remediation

gcloud sql instances patch <example_resource_name> --database-flags="remote access"=off

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_sqlserver_remote_access_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks