Check ID:
Provider: GCP
Service:
Severity: MEDIUM
Categories:
Resource type:
cloudsql_instance_sqlserver_user_connections_flagProvider: GCP
Service:
cloudsqlSeverity: MEDIUM
Categories:
resilienceResource type:
sqladmin.googleapis.com/InstanceWhat this check verifies
Cloud SQL for SQL Server instances are evaluated to ensure theuser connections database flag is set to 0 (unlimited), avoiding any artificial cap on concurrent user sessions
Risk
A cappeduser connections value can exhaust available sessions, causing login failures, aborted transactions, and timeouts. This reduces availability, can delay administrative access, and may lead to integrity issues from failed or inconsistent retries under load.
Recommendation
Setuser connections to 0 to prevent artificial limits. Preserve availability with connection pooling, controlled retries, and capacity planning based on peak usage. If a cap is required, size it with ample headroom, monitor connection counts, and review regularly.
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudSQL/configure-user-connection-flag.html
- https://cloud.google.com/sql/docs/sqlserver/flags
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = cloudsql_instance_sqlserver_user_connections_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks