Check ID:
Provider: GCP
Service:
Severity: MEDIUM
Categories:
Resource type:
cloudsql_instance_sqlserver_trace_flagProvider: GCP
Service:
cloudsqlSeverity: MEDIUM
Categories:
vulnerabilitiesResource type:
sqladmin.googleapis.com/InstanceWhat this check verifies
Cloud SQL for SQL Server instances have the3625 (trace flag) database flag set to on
Risk
Without3625 enabled, SQL errors can reveal parameters and object names to non-admins, weakening confidentiality and aiding targeted injection, account enumeration, and data discovery. Leaked context helps craft exploits and pivot attacks, ultimately risking data integrity and availability.
Recommendation
Set trace flag3625 to on for all SQL Server instances in Cloud SQL to limit error details for non-admins. Apply least privilege, practice defense in depth with application-level error handling, and centralize diagnostics in logs rather than returning verbose messages to clients.
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudSQL/disable-3625-trace-flag.html
- https://cloud.google.com/sql/docs/sqlserver/flags
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = cloudsql_instance_sqlserver_trace_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks