Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Enable "skip_show_database" Flag for MySQL Database Instances

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Medium (should be achieved)
Rule ID: CloudSQL-024

Ensure that the "skip_show_database" database flag is enabled for your Google Cloud MySQL database instances in order to prevent users from using the SHOW DATABASES statement if they don't have this privilege.

This rule resolution is part of the Conformity Security & Compliance tool for GCP.

Security

Enabling the "skip_show_database" flag can improve your data security if you have concerns about users being able to see MySQL databases belonging to other users.

Note: Some database flag settings can affect instance availability and/or stability, and eventually remove the MySQL instance from the Google Cloud SQL Service Level Agreement (SLA).


Audit

To determine if the "skip_show_database" flag is enabled for your Google Cloud MySQL database instances, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the top navigation bar.

03 Navigate to Cloud SQL Instances dashboard at https://console.cloud.google.com/sql/instances.

04 Click inside the Filter box, select Type and MySQL <version>, then press Enter to list only the MySQL database instances provisioned for the selected GCP project.

05 Click on the name (ID) of the database instance that you want to examine.

06 In the navigation panel, select Overview to access the configuration details available for the selected MySQL instance.

07 In the Configuration section, under Database flags, check the configuration value set for the skip_show_database database flag. If skip_show_database is not available in the Database flags list, or the flag is set to off, the "skip_show_database" database flag is disabled for the selected Google Cloud MySQL database instance, therefore the instance configuration is not compliant.

08 Repeat step no. 5 – 7 to check the "skip_show_database" flag value for other MySQL database instances available within the selected project.

09 Repeat steps no. 2 – 8 for each project deployed in your Google Cloud account.

Using GCP CLI

01 Run projects list command (Windows/macOS/Linux) with custom query filters to list the IDs of all the GCP projects available within your Google Cloud account:

gcloud projects list
  --format="table(projectId)"

02 The command output should return the requested GCP project identifiers:

PROJECT_ID
cc-web-project-112233
cc-mobile-project-123123

03 Run sql instances list command (Windows/macOS/Linux) with custom filtering to describe the name of each MySQL database instance provisioned for the selected Google Cloud project:

gcloud sql instances list
  --project cc-web-project-112233
  --filter='DATABASE_VERSION:MYSQL*'
  --format="(NAME)"

04 The command output should return the requested database instance name(s):

NAME:
cc-web-mysql-instance
cc-int-mysql-instance
cc-app-mysql-instance

05 Run sql instances describe command (Windows/macOS/Linux) using the name of the MySQL database instance that you want to examine as the identifier parameter and custom query filters to describe the "skip_show_database" flag configuration value set for the selected database instance:

gcloud sql instances describe cc-web-mysql-instance
  --format=json | jq '.settings.databaseFlags[] | select(.name=="skip_show_database")|.value'

06 The command output should return the requested flag configuration value:

"off"

If the sql instances describe command output returns "off", null, or the command does not produce an output, the "skip_show_database" database flag is not enabled for the selected Google Cloud MySQL database instance, therefore the database configuration is not compliant.

07 Repeat steps no. 5 and 6 to verify the "skip_show_database" flag value for other MySQL database instances created for the selected project.

08 Repeat steps no. 3 – 7 for each project created within your Google Cloud account.

Remediation / Resolution

To turn on the "skip_show_database" database flag for your Google Cloud MySQL database instances, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the top navigation bar.

03 Navigate to Cloud SQL Instances dashboard at https://console.cloud.google.com/sql/instances.

04 Click inside the Filter box, select Type and MySQL <version>, and press Enter to display only the MySQL database instances available for the selected project.

05 Click on the name (ID) of the database instance that you want to reconfigure.

06 In the navigation panel, select Overview to access the configuration details available for the selected instance.

07 Choose Edit from the dashboard top menu to modify the instance configuration.

08 In the Customize your instance section, choose Flags to expand the panel with the database flags configured for the selected MySQL instance.

09 Find the skip_show_database flag and enable it by selecting On from the Value dropdown list. Choose DONE to close the panel. If the flag has not been set on the selected instance before, choose ADD FLAG, select skip_show_database from the Choose a flag dropdown menu, and set the flag value to On. Select DONE to close the panel.
IMPORTANT: Configuring "skip_show_database" flag restarts automatically the selected database instance.

10 Choose SAVE to apply the configuration changes.

11 Repeat steps no. 5 – 10 to configure the specified flag for other MySQL database instances available within the selected GCP project.

12 Repeat steps no. 2 – 11 for each project deployed in your Google Cloud account.

Using GCP CLI

01 Run sql instances patch command (Windows/macOS/Linux) using the name of the MySQL database instance that you want to reconfigure as the identifier parameters, to enable the "skip_show_database" database flag for the selected MySQL instance:

gcloud sql instances patch cc-web-mysql-instance
  --database-flags skip_show_database=on

IMPORTANT: Configuring "skip_show_database" flag restarts automatically the selected database instance.

02 Type Y to confirm the database configuration change:

The following message will be used for the patch API method.
{"name": "cc-web-mysql-instance", "project": "cc-web-project-112233", "settings": {"databaseFlags": [{"name": "skip_show_database", "value": "on"}]}}

WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/postgres/flags - to see if your instance will be restarted when this patch is submitted.

Do you want to continue (Y/n)? Y

03 The output should return the sql instances patch command request status:

Patching Cloud SQL instance...done.

Updated [https://sqladmin.googleapis.com/sql/v1beta4/projects/cc-web-project-112233/instances/cc-web-mysql-instance].

04 Repeat steps no. 1 – 3 to configure the specified flag for other MySQL database instances provisioned for the selected GCP project.

05 Repeat steps no. 1 – 4 for each project created within your Google Cloud account.

References

Publication date May 16, 2022