Back to Checks
gcp

Cloud SQL instance does not allow 0.0.0.0/0 in authorized networks

cloudsql_instance_public_access
Service: cloudsqlSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL authorized networks are checked for the open CIDR 0.0.0.0/0 on instances using a public IP.

The finding flags configurations where a catch-all entry exists instead of specific client ranges.

Prowler logoProwlerprowler-provider-gcp

Risk

Allowing 0.0.0.0/0 makes the database reachable from the Internet, degrading confidentiality and availability. Attackers can brute-force credentials, probe for vulnerable endpoints, exfiltrate data via unauthorized queries, and trigger resource exhaustion through automated scanning.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_public_access

Recommendation

Enforce least privilege network access:

  • Remove 0.0.0.0/0; allow only trusted, fixed IP ranges
  • Prefer private IP or Private Service Connect with VPC controls
  • Use proxied access (Cloud SQL Auth Proxy) over direct public connections
  • Apply org policies to prevent broad allowlists

Remediation

CLI

gcloud sql instances patch <INSTANCE_NAME> --authorized-networks=""

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  database_version = "<DATABASE_VERSION>"

  settings {
    tier = "<TIER>"

    ip_configuration {
      authorized_networks {
        value = "<ALLOWED_CIDR>" # Critical: remove 0.0.0.0/0; allow only specific CIDR to pass the check
      }
    }
  }
}

Other

1In Google Cloud Console, go to SQL > Instances and select your instance
2Open the Connections tab
3Under Authorized networks, delete the entry 0.0.0.0/0
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_public_access(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"Database Instance {instance.name} does not whitelist all Public IP Addresses."
            for network in instance.authorized_networks:
                if network["value"] == "0.0.0.0/0":
                    report.status = "FAIL"
                    report.status_extended = f"Database Instance {instance.name} whitelist all Public IP Addresses."
            findings.append(report)

        return findings

References