Check ID: cloudsql_instance_sqlserver_trace_flag
Provider: GCP
Service: cloudsql
Severity: MEDIUM
Categories: vulnerabilities
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL for SQL Server instances have the 3625 (trace flag) database flag set to on

Risk

Without 3625 enabled, SQL errors can reveal parameters and object names to non-admins, weakening confidentiality and aiding targeted injection, account enumeration, and data discovery. Leaked context helps craft exploits and pivot attacks, ultimately risking data integrity and availability.

Recommendation

Set trace flag 3625 to on for all SQL Server instances in Cloud SQL to limit error details for non-admins. Apply least privilege, practice defense in depth with application-level error handling, and centralize diagnostics in logs rather than returning verbose messages to clients.

Remediation

gcloud sql instances patch <INSTANCE_NAME> --database-flags=3625=on

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_sqlserver_trace_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks