Info icon
End of Life Notice: For Trend Cloud One™ - Conformity Customers, Conformity will reach its End of Sale on “July 31st, 2025” and End of Life “July 31st, 2026”. The same capabilities and much more is available in TrendAI Vision One™ Cloud Risk Management. For details, please refer to Upgrade to TrendAI Vision One™
Logo of TrendAI

Enable Cloud SQL Deletion Protection

TrendAI Vision One™ provides continuous assurance that gives peace of mind for your cloud infrastructure, delivering over 1400 automated best practice checks.

Risk Level: Medium (should be achieved)

Ensure that deletion protection is enabled on all Google Cloud Platform (GCP) Cloud SQL database instances. Deletion protection is a safety mechanism that prevents accidental or malicious deletion of critical database instances. When enabled, the deletion protection setting requires users to explicitly disable the protection before they can delete an instance, adding an additional safeguard to the deletion workflow. This setting does not impact database performance, availability, or operational overhead—it only affects delete operations.

Security
Reliability

Cloud SQL instances without deletion protection can be permanently deleted with a single API call or console action, allowing compromised credentials, operational errors, or malicious insiders to cause catastrophic data loss. By requiring deliberate action to disable deletion protection before an instance can be deleted, organizations mitigate risks associated with accidental data deletion and enhance the overall resilience of their data storage platform. This control is particularly important for production workloads where data loss could result in significant business disruption, regulatory compliance violations, and reputational damage. Note: The GCP Console calls this "Deletion prevention" while the CLI uses "Deletion protection" — they refer to the same feature.

Audit

To determine if deletion protection is enabled on all Cloud SQL database instances, perform the following operations:

Using GCP Console

  1. Sign in to the Google Cloud Management Console.

  2. Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

  3. Navigate to Cloud SQL console available at https://console.cloud.google.com/sql.

  4. In the Instances list, click on the name of a Cloud SQL database instance to open its instance details page.

  5. In the Configuration section, check the Instance deletion prevention setting.

  6. Verify that the Instance deletion prevention status is enabled. If it is disabled, the instance is not protected against accidental deletion.

  7. Repeat steps no. 4 – 6 for each Cloud SQL database instance available in the selected project.

  8. Repeat steps no. 2 – 7 for each project available within your Google Cloud account.

Using GCP Command Line Interface (CLI)

  1. Run projects list command (Windows/macOS/Linux) to list all projects available in your Google Cloud account:

    gcloud projects list
--format="table(projectId,name,projectNumber)"

  2. Run config set command (Windows/macOS/Linux) to set the current project:

    gcloud config set project <PROJECT_ID>

    Replace <PROJECT_ID> with the project ID from the list returned in step 1.

  3. Run sql instances list command (Windows/macOS/Linux) with output query filters to list all Cloud SQL database instances available in your Google Cloud account:

    gcloud sql instances list
--format="table(name,settings.deletionProtectionEnabled)"

  4. The command output should return the list of Cloud SQL instances with their deletion protection status:

    NAME                          DELETION_PROTECTION_ENABLED
cc-prod-mysql-instance        True
cc-dev-mysql-instance         False
cc-staging-postgres-instance  True

  5. For each instance returned in the output, run sql instances describe command (Windows/macOS/Linux) to verify the deletion protection status:

    gcloud sql instances describe <INSTANCE_NAME>
--format="value(settings.deletionProtectionEnabled)"

  6. The command output should return True, indicating that deletion protection is enabled:

    True

    If the command returns False or empty output, the instance does not have deletion protection enabled.

  7. Repeat steps no. 5 – 6 to verify the deletion protection status for other Cloud SQL database instances in the selected project.

  8. Repeat steps no. 1 – 7 for each project available within your Google Cloud account.

Remediation / Resolution

To enable deletion protection on Cloud SQL database instances, perform the following operations:

Using GCP Console

  1. Sign in to the Google Cloud Management Console.

  2. Select the Google Cloud Platform (GCP) project that contains the Cloud SQL instances you want to remediate from the console top navigation bar.

  3. Navigate to Cloud SQL console available at https://console.cloud.google.com/sql.

  4. In the Instances list, click on the name of a Cloud SQL database instance that does not have deletion protection enabled to open its instance details page.

  5. Click the Edit button at the top of the instance details page.

  6. In the Edit instance form, scroll down to the Data Protection section and locate the Instance deletion protection option.

  7. Enable the Prevent instance deletion toggle switch.

  8. Click the Save button to apply the changes.

  9. Wait for the instance configuration to update. The operation typically completes within a few seconds.

  10. Repeat steps no. 4 – 9 for each Cloud SQL database instance that does not have deletion protection enabled.

  11. Repeat steps no. 2 – 10 for each project available within your Google Cloud account.

Using GCP Command Line Interface (CLI)

  1. Run sql instances patch command (Windows/macOS/Linux) to enable deletion protection on a Cloud SQL database instance:

    gcloud sql instances patch <INSTANCE_NAME>
--deletion-protection

    Replace <INSTANCE_NAME> with the name of the Cloud SQL instance where you want to enable deletion protection.

  2. The command output should return a confirmation message indicating the instance is being updated:

    Patching instance...done.
Updated [cc-prod-mysql-instance].

  3. Verify that deletion protection is now enabled by running the sql instances describe command (Windows/macOS/Linux):

    gcloud sql instances describe <INSTANCE_NAME>
--format="value(settings.deletionProtectionEnabled)"

  4. The command output should return True, confirming that deletion protection is now enabled:

    True

  5. Repeat steps no. 1 – 4 to enable deletion protection for other Cloud SQL database instances that do not have this setting enabled.

  6. Repeat steps no. 1 – 5 for each project available within your Google Cloud account.

References

Publication date Sep 8, 2026

Related CloudSQL rules