Back to Checks
gcp

Cloud SQL instance has high availability (REGIONAL) configured

cloudsql_instance_high_availability_enabled
Service: cloudsqlSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:sqladmin.googleapis.com/Instance

Ensures that Cloud SQL instances have high availability configured by setting availabilityType to REGIONAL. A REGIONAL instance maintains a standby replica in a different zone within the same region and automatically fails over on zone-level outages.

Prowler logoProwlerprowler-provider-gcp

Risk

Instances with ZONAL availability have no standby replica. A zone-level outage will cause database downtime until manual recovery, violating availability requirements and potentially breaching SLAs and ISMS-P 2.12.1 disaster preparedness controls.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_high_availability_enabled

Recommendation

Set availabilityType to REGIONAL for all production Cloud SQL instances. This creates a standby replica in a different zone and enables automatic failover, reducing RTO in the event of a zone outage.

Remediation

CLI

gcloud sql instances patch <INSTANCE_NAME> --availability-type=REGIONAL

Terraform

resource "google_sql_database_instance" "example" {
  name             = "<instance_name>"
  database_version = "POSTGRES_15"
  region           = "<region>"

  settings {
    tier = "db-custom-2-7680"

    availability_type = "REGIONAL"  # Critical: enables HA standby replica

    backup_configuration {
      enabled    = true
      start_time = "02:00"
    }
  }
}

Other

1Go to Google Cloud Console > SQL > Instances.
2Click the instance name, then Edit.
3Under Availability, select Multiple zones (Highly available).
4Click Save.

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_high_availability_enabled(Check):
    """Check that Cloud SQL primary instances are configured for high availability.

    Verifies that each Cloud SQL primary instance has `availabilityType` set to
    `REGIONAL`, which provisions a standby replica in a different zone within
    the same region and enables automatic failover on zone-level outages. Read
    replicas are skipped because they inherit availability from their primary.
    """

    def execute(self) -> list[Check_Report_GCP]:
        """Execute the high availability check across all Cloud SQL instances.

        Returns:
            A list of `Check_Report_GCP` findings, one per Cloud SQL primary
            instance. Status is `PASS` when `availability_type == "REGIONAL"`
            and `FAIL` otherwise.
        """
        findings = []
        for instance in cloudsql_client.instances:
            if instance.instance_type != "CLOUD_SQL_INSTANCE":
                continue
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
            if instance.availability_type == "REGIONAL":
                report.status = "PASS"
                report.status_extended = (
                    f"Database instance {instance.name} has high availability "
                    f"(REGIONAL) configured."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Database instance {instance.name} does not have high "
                    f"availability configured (current: "
                    f"{instance.availability_type})."
                )
            findings.append(report)
        return findings

References