Cloud SQL SQL Server: user options flag is not set

Check ID: cloudsql_instance_sqlserver_user_options_flag
Provider: GCP
Service: cloudsql
Severity: MEDIUM
Categories: vulnerabilities
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL for SQL Server instances are evaluated for the user options database flag configured with any value. This flag sets global defaults for session SET behaviors; the check identifies instances where this global override is present.

Risk

Global user options changes affect all sessions, impacting data integrity and availability. Disabling safe ANSI behaviors or enabling implicit transactions can alter NULL comparisons and error handling, leading to inconsistent results, lock contention, and application failures, reducing predictability and complicating auditing.

Recommendation

Leave user options unset at the instance level; keep default behavior. Control SET options explicitly at session or database scope.

Enforce least privilege for flag management
Use change control and testing before rollout
Monitor for configuration drift as part of defense in depth

Remediation

CLI
Terraform
Dashboard steps

gcloud sql instances patch <example_resource_name> —clear-database-flags

# Cloud SQL for SQL Server instance with no 'user options' flag set
resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<example_region>"
  database_version = "SQLSERVER_2019_STANDARD"

  settings {
    tier = "db-custom-2-7680"
    # Remediation: Do NOT set a database_flags block for 'user options'
    # This omission removes/unsets the 'user options' flag so the check passes.
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_sqlserver_user_options_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL SQL Server: user connections = 0 Cloud SQL instance requires SSL for all connections

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires