Back to Checks
gcp

Cloud SQL SQL Server instance has 'external scripts enabled' flag set to 'off'

cloudsql_instance_sqlserver_external_scripts_enabled_flag
Service: cloudsqlSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL for SQL Server instances have the external scripts enabled database flag set to off

Prowler logoProwlerprowler-provider-gcp

Risk

Allowing external scripts lets SQL invoke language extensions (e.g., R/Python), enabling arbitrary code execution. This can cause data exfiltration (confidentiality), tampered query results (integrity), and resource exhaustion or service degradation (availability), and may facilitate lateral movement from the database layer.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_sqlserver_external_scripts_enabled_flag

Recommendation

Keep external scripts enabled set to off. Apply least privilege and defense in depth by disabling code-execution features in the database. If analytics are required, use isolated instances, restrict outbound network access, and enforce change control and auditing to prevent misuse.

Remediation

CLI

gcloud sql instances patch <INSTANCE_NAME> --database-flags="external scripts enabled"=off

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<REGION>"
  database_version = "SQLSERVER_2019_STANDARD"

  settings {
    tier = "db-custom-2-7680"

    # Critical: disables external scripts on the SQL Server instance
    database_flags {
      name  = "external scripts enabled"  # sets the flag
      value = "off"                        # required value to pass the check
    }
  }
}

Other

1In Google Cloud Console, go to SQL > Instances and select the SQL Server instance
2Click Edit
3In the Flags section, add or locate "external scripts enabled"
4Set its value to Off
5Click Save to apply (the instance may restart)

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_sqlserver_external_scripts_enabled_flag(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            if "SQLSERVER" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "PASS"
                report.status_extended = f"SQL Server Instance {instance.name} has 'external scripts enabled' flag set to 'off'."
                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "external scripts enabled"
                        and flag.get("value", "off") == "on"
                    ):
                        report.status = "FAIL"
                        report.status_extended = f"SQL Server Instance {instance.name} does not have 'external scripts enabled' flag set to 'off'."
                        break
                findings.append(report)

        return findings

References