Back to Checks
gcp

Cloud SQL MySQL instance has skip_show_database flag set to on

cloudsql_instance_mysql_skip_show_database_flag
Service: cloudsqlSeverity: low
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL MySQL instances configure the skip_show_database database flag to on, limiting use of SHOW DATABASES to accounts with the SHOW DATABASES privilege.

Prowler logoProwlerprowler-provider-gcp

Risk

Without skip_show_database set to on, database names can be exposed to unprivileged users, reducing confidentiality. Attackers can perform schema enumeration and targeted probing, enabling lateral movement and privilege escalation against specific datasets.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_mysql_skip_show_database_flag

Recommendation

Set skip_show_database to on for all Cloud SQL MySQL instances. Enforce least privilege by granting SHOW DATABASES only when necessary and reviewing roles regularly. Use defense in depth: monitor access and admin actions, and plan changes in maintenance windows as flag updates may trigger restarts.

Remediation

CLI

gcloud sql instances patch <INSTANCE_NAME> --database-flags=skip_show_database=on

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  database_version = "MYSQL_8_0"
  region           = "<example_region>"

  settings {
    tier = "db-custom-1-3840"

    database_flags {
      name  = "skip_show_database"   # Critical: enforce hiding databases from users without SHOW DATABASES privilege
      value = "on"                   # Critical: set flag to 'on' to pass the check
    }
  }
}

Other

1In Google Cloud Console, go to Cloud SQL > Instances
2Open your MySQL instance and click Edit
3Under Flags, click Add item, select skip_show_database, set value to ON
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_mysql_skip_show_database_flag(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            if "MYSQL" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "FAIL"
                report.status_extended = f"MySQL Instance {instance.name} does not have 'skip_show_database' flag set to 'on'."
                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "skip_show_database"
                        and flag.get("value", "off") == "on"
                    ):
                        report.status = "PASS"
                        report.status_extended = f"MySQL Instance {instance.name} has 'skip_show_database' flag set to 'on'."
                        break
                findings.append(report)

        return findings

References