Ensure that the "skip_show_database" database flag is enabled for your Google Cloud MySQL database instances in order to prevent users from using the SHOW DATABASES statement if they don't have this privilege.
This rule resolution is part of the Conformity Security & Compliance tool for GCP.
Enabling the "skip_show_database" flag can improve your data security if you have concerns about users being able to see MySQL databases belonging to other users.
Note: Some database flag settings can affect instance availability and/or stability, and eventually remove the MySQL instance from the Google Cloud SQL Service Level Agreement (SLA).
Audit
To determine if the "skip_show_database" flag is enabled for your Google Cloud MySQL database instances, perform the following operations:
Remediation / Resolution
To turn on the "skip_show_database" database flag for your Google Cloud MySQL database instances, perform the following operations:
References
- Google Cloud Platform (GCP) Documentation
- Cloud SQL for MySQL documentation
- Configure database flags
- Edit instances
- CIS Security Documentation
- Securing Google Cloud Computing Platform
- GCP Command Line Interface (CLI) Documentation
- gcloud projects list
- gcloud sql instances list
- gcloud sql instances describe
- gcloud sql instances patch