Ensure that "Restrict Authorized Networks on Cloud SQL instances" policy is enforced for your Google Cloud Platform (GCP) organization to deny IAM members to add authorized networks in order to provide access to your security-critical SQL database instances.
By default, authorized networks can be added to any Cloud SQL database instance. The "sql.restrictAuthorizedNetworks" constraint, implemented by the "Restrict Authorized Networks on Cloud SQL instances" organization policy, restricts adding authorized networks for unproxied database access to Cloud SQL instances where the constraint is set to True. This boolean constraint is not retroactive, Cloud SQL database instances with existing authorized networks will still work as expected even after the constraint is enforced.
Audit
To determine if "Restrict Authorized Networks on Cloud SQL instances" policy is enabled for your GCP organization, perform the following operations:
Remediation / Resolution
To ensure that adding authorized networks for Cloud SQL database instances is disabled within your Google Cloud organization, enable the “Restrict Authorized Networks on Cloud SQL instances” organization policy by performing the following operations:
References
- Google Cloud Platform (GCP) Documentation
- Authorizing with authorized networks
- Connection organization policies
- Organization policy constraints
- GCP Command Line Interface (CLI) Documentation
- organizations
- gcloud alpha resource-manager org-policies describe
- gcloud alpha resource-manager org-policies enable-enforce
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
![Confirmity Cloud Platform](/cloudoneconformity/assets/v2/images/common/conformity-platform-cloud.png)
You are auditing:
Restrict Authorized Networks on Cloud SQL instances
Risk Level: Medium