Back to Checks
gcp

Cloud SQL MySQL instance has the local_infile database flag set to off

cloudsql_instance_mysql_local_infile_flag
Service: cloudsqlSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL for MySQL instances are evaluated for the local_infile database flag being explicitly set to off, disabling use of LOAD DATA LOCAL.

Instances where local_infile is absent or not off are identified.

Prowler logoProwlerprowler-provider-gcp

Risk

With local_infile enabled, clients can send local files via LOAD DATA LOCAL. A stolen credential or SQL injection can coerce clients to leak files and mass-ingest unvetted data, compromising confidentiality and integrity, and aiding lateral movement through secrets imported into the database.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_mysql_local_infile_flag

Recommendation

Keep local_infile set to off. Use governed import channels (e.g., controlled object storage imports) and enforce least privilege for bulk-loading. Apply separation of duties between ingestion and admin roles, validate file sources and formats, and monitor high-volume loads. If ever needed, enable only briefly for vetted tasks.

Remediation

CLI

gcloud sql instances patch <INSTANCE_NAME> --database-flags=local_infile=off

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  database_version = "MYSQL_8_0"
  region           = "<example_region>"

  settings {
    tier = "<example_tier>"
    # Critical: disables LOCAL INFILE to pass the check
    database_flags {
      name  = "local_infile"  # sets the specific flag
      value = "off"           # required value for compliance
    }
  }
}

Other

1In Google Cloud Console, go to SQL
2Select the MySQL instance and click Edit
3In Database flags, add or locate "local_infile" and set it to Off
4Click Save to apply changes

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_mysql_local_infile_flag(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            if "MYSQL" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "FAIL"
                report.status_extended = f"MySQL Instance {instance.name} does not have 'local_infile' flag set to 'off'."
                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "local_infile"
                        and flag.get("value", "on") == "off"
                    ):
                        report.status = "PASS"
                        report.status_extended = f"MySQL Instance {instance.name} has 'local_infile' flag set to 'off'."
                        break
                findings.append(report)

        return findings

References