Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Check for Cloud SQL Database Instances with Public IPs

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Medium (should be achieved)
Rule ID: CloudSQL-001

Ensure that your Google Cloud SQL database instances are configured to use private IP addresses instead of public IPs in order to protect against potential attacks.

This rule resolution is part of the Conformity Security & Compliance tool for GCP.

Security

By default, each Google Cloud SQL database instance is configured with a public IP address. To reduce the application's attack surface, Cloud SQL databases should have only private IPs attached. Private IPs provide improved cloud network security and lower latency for your database applications.


Audit

To determine if your Cloud SQL database instances are using public IP addresses, perform the following actions:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 Navigate to SQL Instances console at https://console.cloud.google.com/sql/instances.

04 Choose the Cloud SQL database instance that you want to examine and check the Public IP address and Private IP address columns for any public and/or private IPv4 addresses assigned to the selected resource. If the database instance has a public IP address assigned but has no private IP address configured, the selected Google Cloud SQL database instance is configured to use public IP addresses only.

05 Repeat step no. 4 to check the public and private IP status for other database instances created for the selected project.

06 Repeat steps no. 2 – 5 for each project deployed in your Google Cloud Platform (GCP) account.

Using GCP CLI

01 Run projects list command (Windows/macOS/Linux) using custom query filters to list the IDs of all the Google Cloud Platform (GCP) projects available in your Google Cloud account:

gcloud projects list
  --format="table(projectId)"

02 The command output should return the requested GCP project identifiers:

PROJECT_ID
  cc-web-mysql-instance
  cc-ml-app-project-123123

03 Run sql instances list command (Windows/macOS/Linux) with custom filtering to describe the name of each Cloud SQL database instance provisioned for the selected Google Cloud project:

gcloud sql instances list
  --project cc-mobile-project-123123
  --format="(NAME)"

04 The command output should return the requested database instance names:

NAME
cc-mobile-db-instance
cc-development-db-instance

05 Run sql instances describe command (Windows/macOS/Linux) using the name of the Cloud SQL database instance that you want to examine as the identifier parameter and custom output filters to describe the public and/or private IPv4 addresses associated with the selected database instance:

gcloud sql instances describe cc-web-mysql-instance
  --format=json | jq '.ipAddresses[]'

06 The command output should return the requested IPv4 configuration details:

{
	"ipAddress": "xxx.xxx.xxx.xxx",
	"type": "PRIMARY"
}

If the sql instances describe command output does not return an IP configuration object with the "type" attribute set only to "PRIVATE", the selected Google Cloud SQL database instance is configured to use public IP addresses only and may be exposed to potential security risks.

07 Repeat steps no. 5 and 6 to verify other Cloud SQL database instances for public IPs, available within the selected project.

08 Repeat steps no. 3 – 7 for each project available within your Google Cloud Platform (GCP) account.

Remediation / Resolution

To reconfigure your Google Cloud SQL database instances in order to use private IP addresses instead of public IPs, perform the following actions:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 Navigate to SQL Instances console at https://console.cloud.google.com/sql/instances.

04 Click on the name (ID) of the database instance that you want to configure.

05 In the resource navigation panel, select Connections to access the connectivity configuration information available for the selected database instance.

06 Select the NETWORKING tab and perform the following operations:

  1. Select the Private IP checkbox to initiate the private IP setup process.
  2. Select the name of the VPC network that you want to use for private IP connectivity, from the Associated networking dropdown list.
  3. For Private services access connection required choose SET UP CONNECTION.
  4. If the required service API is not enabled, for Enable Service Networking API choose ENABLE API to enable Google Service Networking API for private IP connectivity. This is a one-time enablement per GCP project and may take a few minutes to complete. Select CONTINUE.
  5. For Allocate an IP range choose Use an automatically allocated IP range option to automatically allocate an IP range of prefix-length 20 within the selected VPC network. Select CONTINUE.
  6. Review the connection details and choose CREATE CONNECTION to assign a new private IPv4 address to the selected Cloud SQL database instance.
  7. On the NETWORKING panel, deselect the Public IP checkbox to deallocate the public IP address. Removing the public IPv4 allocated for the selected instance may break some of the applications connected to the database. Before deallocate the public IP, make sure that you update your applications configuration to reference the new private IP address.
  8. Choose SAVE to apply the changes.

07 Repeat steps no. 4 – 6 for other Cloud SQL instances that use public IPs for database access, available within the selected project.

08 Repeat steps no. 2 – 7 for each project deployed in your Google Cloud Platform (GCP) account.

Using GCP CLI

01 Run sql instances patch command (Windows/macOS/Linux) using the name of the Google Cloud SQL database instance that you want to configure and the name of the appropriate VPC network as the identifier parameters, to remove the instance's public IP address and assign a private IP address instead:

gcloud sql instances patch cc-web-mysql-instance
  --project cc-mobile-project-123123
  --network=cc-web-stack-network
  --no-assign-ip

02 The output should return the **sql instances patch** command request information:

The following message will be used for the patch API method.
{"name": "cc-web-mysql-instance", "project": "cc-mobile-project-123123", "settings": {"ipConfiguration": {"ipv4Enabled": false, "privateNetwork": "https://compute.googleapis.com/compute/v1/projects/cc-mobile-project-123123/global/networks/cc-web-stack-network"}}}
Patching Cloud SQL instance...done.
Updated [https://sqladmin.googleapis.com/sql/v1beta4/projects/cc-mobile-project-123123/instances/cc-mobile-db-instance].

03 Repeat steps no. 1 and 2 for other Cloud SQL instances that use public IPs for database access, provisioned for the selected project.

04 Repeat steps no. 1 – 3 for each project created within your Google Cloud Platform (GCP) account.

References

Publication date Apr 12, 2021