Back to Checks
gcp

Cloud SQL for SQL Server instance has 'contained database authentication' flag set to off

cloudsql_instance_sqlserver_contained_database_authentication_flag
Service: cloudsqlSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL for SQL Server instances are evaluated for the contained database authentication setting. The check inspects the contained database authentication flag and expects its value to be off.

Prowler logoProwlerprowler-provider-gcp

Risk

Enabling contained authentication moves identity checks to the database, bypassing server-level logins and policies. This weakens centralized controls and auditing, enables password spraying on contained users, and can persist users across copies, increasing unauthorized data access and tampering risk to confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_sqlserver_contained_database_authentication_flag

Recommendation

Keep contained database authentication set to off. Centralize authentication and auditing at the server layer or via directory integration, and apply least privilege. Avoid USER WITH PASSWORD contained users. If containment is unavoidable, tightly scope usage, enforce strong credentials, and monitor login activity.

Remediation

CLI

gcloud sql instances patch <INSTANCE_NAME> --database-flags="contained database authentication"=off

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<REGION>"
  database_version = "SQLSERVER_2019_STANDARD"

  settings {
    tier = "<TIER>"
    database_flags {
      name  = "contained database authentication" # critical: target flag
      value = "off"                                # critical: disable contained DB auth
    }
  }
}

Other

1In Google Cloud Console, go to Cloud SQL > Instances
2Open the SQL Server instance
3Click Edit
4In Database flags, add or edit: contained database authentication = Off
5Click Save (the instance may restart)

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_sqlserver_contained_database_authentication_flag(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            if "SQLSERVER" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "PASS"
                report.status_extended = f"SQL Server Instance {instance.name} has 'contained database authentication' flag set to 'off'."
                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "contained database authentication"
                        and flag.get("value", "off") == "on"
                    ):
                        report.status = "FAIL"
                        report.status_extended = f"SQL Server Instance {instance.name} has 'contained database authentication' flag set to 'on'."
                        break
                findings.append(report)

        return findings

References