Back to Checks
gcp

Cloud SQL database instance does not have a public IP address

cloudsql_instance_public_ip
Service: cloudsqlSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL instances are evaluated for exposure via public IP addresses instead of private IP connectivity within a VPC.

Instances with an externally routable database endpoint are surfaced.

Prowler logoProwlerprowler-provider-gcp

Risk

Public DB endpoints expand attack surface:

  • Credential brute force and SQL injection threaten confidentiality and integrity
  • Internet DDoS reduces availability
  • Exposure bypasses VPC controls, easing lateral movement and data exfiltration

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_public_ip

Recommendation

Prefer private IP and disable public endpoints. Access databases over VPC, VPN/Interconnect, or Private Service Connect. If authorized networks are required, restrict to specific sources-never 0.0.0.0/0. Enforce least privilege IAM, use Cloud SQL connectors/proxy, and layer defense in depth with network controls and monitoring.

Remediation

CLI

gcloud beta sql instances patch <example_resource_id> --project=<example_resource_id> --network=projects/<example_resource_id>/global/networks/<example_resource_name> --no-assign-ip

Terraform

# Cloud SQL instance without public IP
resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<REGION>"
  database_version = "MYSQL_8_0"

  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ipv4_enabled   = false  # Critical: disables public (IPv4) IP
      private_network = "projects/<example_project_id>/global/networks/<example_resource_name>"  # Critical: ensures private IP via specified VPC
    }
  }
}

Other

1In Google Cloud Console, go to Cloud SQL > Instances and select <example_resource_name>
2Open Connections > Networking
3Check Private IP and select the VPC network; if prompted, click Set up connection to create the private service connection
4Uncheck Public IP
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_public_ip(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = (
                f"Database Instance {instance.name} does not have a public IP."
            )
            if instance.public_ip:
                report.status = "FAIL"
                report.status_extended = (
                    f"Database Instance {instance.name} has a public IP."
                )
            findings.append(report)

        return findings

References