Back to Checks
gcp

Cloud SQL SQL Server instance has 'cross db ownership chaining' flag set to off

cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag
Service: cloudsqlSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesstrust-boundaries
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL SQL Server instances are evaluated for the cross db ownership chaining server flag. The finding identifies SQL Server instances where this flag isn't set to off, meaning cross-database ownership chaining is permitted.

Prowler logoProwlerprowler-provider-gcp

Risk

Allowing cross-database ownership chaining erodes database boundaries, impacting confidentiality and integrity. Users with privileges in one database can traverse ownership chains to access or modify objects in others, enabling privilege escalation, lateral movement, and unauthorized data exposure.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag

Recommendation

Keep cross db ownership chaining set to off to maintain database isolation. Enforce least privilege with explicit per-database permissions and separation of duties. Prefer controlled execution patterns (e.g., signed modules) over implicit trusts, and periodically review flags and access. This flag is deprecated-do not enable it.

Remediation

CLI

gcloud sql instances patch <example_resource_name> --database-flags '"cross db ownership chaining"=off'

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<REGION>"
  database_version = "SQLSERVER_2019_STANDARD"

  settings {
    tier = "<TIER>"

    # Critical: ensures the flag is OFF to pass the check
    database_flags {
      name  = "cross db ownership chaining"  # disables cross-database ownership chaining
      value = "off"
    }
  }
}

Other

1In the Google Cloud Console, go to SQL > Instances
2Open the SQL Server instance (<example_resource_name>) and click Edit
3Scroll to Flags and click Add item (or edit if present)
4Select cross db ownership chaining and set value to off
5Click Save and restart if prompted

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            if "SQLSERVER" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "PASS"
                report.status_extended = f"SQL Server Instance {instance.name} has 'cross db ownership chaining' flag set to 'off'."
                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "cross db ownership chaining"
                        and flag.get("value", "off") == "on"
                    ):
                        report.status = "FAIL"
                        report.status_extended = f"SQL Server Instance {instance.name} does not have 'cross db ownership chaining' flag set to 'off'."
                        break
                findings.append(report)

        return findings

References