Cloud SQL instance requires SSL for all connections

Check ID: cloudsql_instance_ssl_connections
Provider: GCP
Service: cloudsql
Severity: HIGH
Categories: encryption
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL instances enforce SSL/TLS-only connections, rejecting plaintext traffic. The connection policy requires encryption for all clients (e.g., ENCRYPTED_ONLY or TRUSTED_CLIENT_CERTIFICATE_REQUIRED) instead of allowing both encrypted and unencrypted connections.

Risk

Without enforced TLS, database traffic is exposed to interception.

MITM can read creds and query results (confidentiality)
Inject/alter statements to corrupt data (integrity)

Mixed modes cause accidental plaintext use on public or untrusted networks.

Recommendation

Require TLS for all connections. Prefer TRUSTED_CLIENT_CERTIFICATE_REQUIRED or use Cloud SQL Auth Proxy/Connectors for encrypted, authenticated channels.

Disallow mixed plaintext/SSL modes
Rotate and monitor certificates
Combine with least privilege and private access

Remediation

CLI
Terraform
Dashboard steps

gcloud sql instances patch <INSTANCE_NAME> --ssl-mode=ENCRYPTED_ONLY

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<region>"
  database_version = "<database_version>"

  settings {
    tier = "<tier>"
    ip_configuration {
      ssl_mode = "ENCRYPTED_ONLY" # Critical: only allow SSL/TLS-encrypted connections
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_ssl_connections. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL SQL Server: user options flag is not set Data Access audit logs are enabled for Cloud Storage

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires