gcp-cloudsql-public-ip-open-network
A Cloud SQL instance with a public IP (ipv4Enabled=true) and an authorized network of 0.0.0.0/0 is TCP-reachable from the internet on the DB port, exposing it to unauthenticated network-level attack (brute-force, known CVEs).
match (record)
{
"field": "settings.ipConfiguration.ipv4Enabled == true AND settings.ipConfiguration.authorizedNetworks[].value contains 0.0.0.0/0",
"resource_type": "google.sql.Instance"
}
where
instance.state == RUNNABLE
emit
| source type | RelationalDatabase |
|---|---|
| target type | AnonymousIdentity |
| source | <Cloud SQL Instance node> |
| target | <AnonymousIdentity> |
| conditions | service_state |
| state logic | ACTIVE when ipv4Enabled=true AND an authorizedNetworks entry with value 0.0.0.0/0 (or ::/0 for IPv6) is present AND instance.state == RUNNABLE; CONDITIONAL(service_state) when instance state cannot be confirmed or is SUSPENDED; BLOCKED when an org policy (e.g. constraints/sql.restrictAuthorizedNetworks) prevents 0.0.0.0/0 entries or when Cloud Armor / a WAF-equivalent blocks the DB port. |
Narrative
Cloud SQL instance {instance.name} has a public IP address with authorized network 0.0.0.0/0; any internet host can connect to its DB port ({instance.backendType}: 3306/MySQL, 5432/PostgreSQL, 1433/SQL Server) and attempt authentication - including password brute-force or exploitation of DB engine vulnerabilities.
Raw rule rules/derived/gcp/cloudsql.yaml
id: gcp-cloudsql-public-ip-open-network
emits: ExposedToInternet
description: A Cloud SQL instance with a public IP (ipv4Enabled=true) and an authorized network of 0.0.0.0/0
is TCP-reachable from the internet on the DB port, exposing it to unauthenticated network-level attack
(brute-force, known CVEs).
match_record:
resource_type: google.sql.Instance
field: settings.ipConfiguration.ipv4Enabled == true AND settings.ipConfiguration.authorizedNetworks[].value
contains 0.0.0.0/0
where:
- instance.state == RUNNABLE
emit:
source_type: RelationalDatabase
target_type: AnonymousIdentity
source: <Cloud SQL Instance node>
target: <AnonymousIdentity>
permissions: []
conditions:
- service_state
state_logic: ACTIVE when ipv4Enabled=true AND an authorizedNetworks entry with value 0.0.0.0/0 (or ::/0
for IPv6) is present AND instance.state == RUNNABLE; CONDITIONAL(service_state) when instance state
cannot be confirmed or is SUSPENDED; BLOCKED when an org policy (e.g. constraints/sql.restrictAuthorizedNetworks)
prevents 0.0.0.0/0 entries or when Cloud Armor / a WAF-equivalent blocks the DB port.
false_positive_note: "requireSsl=true does NOT prevent network reachability \u2014 the instance is still\
\ TCP-reachable; TLS enforcement is a transport-layer control, not a network- access control. requireSsl\
\ only means unauthenticated plaintext connections are rejected; a TLS-capable attacker can still\
\ reach the port. authorizedNetworks is an IP allowlist: only 0.0.0.0/0 (or a superset like ::/0)\
\ constitutes full internet exposure. Specific CIDR entries (e.g. 10.0.0.0/8) are NOT internet-exposed.\
\ Check each authorizedNetworks[].value entry individually; do not flag instances where only private\
\ CIDRs are listed. Instances with ONLY private IP (ipv4Enabled=false) are NOT internet-exposed via\
\ this vector even if authorizedNetworks is unconstrained (private-only instances have no public IP\
\ to reach). Also check the instance has a RUNNABLE state; SUSPENDED / FAILED instances are not actively\
\ serving connections."
narrative: "Cloud SQL instance {instance.name} has a public IP address with authorized network 0.0.0.0/0;\
\ any internet host can connect to its DB port ({instance.backendType}: 3306/MySQL, 5432/PostgreSQL,\
\ 1433/SQL Server) and attempt authentication \u2014 including password brute-force or exploitation\
\ of DB engine vulnerabilities."
derived_from:
- google.sql.Instance.settings.ipConfiguration.ipv4Enabled == true
- google.sql.Instance.settings.ipConfiguration.authorizedNetworks[].value == 0.0.0.0/0
- google.sql.Instance.state == RUNNABLE