Back to Checks
gcp

Cloud SQL SQL Server instance has 'remote access' database flag set to 'off'

cloudsql_instance_sqlserver_remote_access_flag
Service: cloudsqlSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL for SQL Server instances where the remote access database flag is on, allowing remote procedure calls between servers

Prowler logoProwlerprowler-provider-gcp

Risk

Enabling remote procedure calls expands exposure: untrusted servers can invoke stored procedures, leading to data exfiltration (confidentiality), unauthorized changes (integrity), and DoS via resource-heavy remote execution (availability). It can also enable lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_sqlserver_remote_access_flag

Recommendation

Set remote access to off to reduce the attack surface. Apply least privilege and defense in depth: avoid remote stored procedures; if business-required, allow only trusted peers, enforce strong authentication, audit calls, and monitor for abuse.

Remediation

CLI

gcloud sql instances patch <example_resource_name> --database-flags="remote access"=off

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  database_version = "SQLSERVER_2019_STANDARD"
  region           = "<example_region>"

  settings {
    tier = "<example_tier>"

    # Critical: disables SQL Server remote access to pass the check
    database_flags {
      name  = "remote access"
      value = "off"  # sets the flag to off
    }
  }
}

Other

1In Google Cloud Console, go to Cloud SQL > Instances
2Open the SQL Server instance (<example_resource_name>) and click Edit
3Scroll to Database flags and click Add item
4Select "remote access" and set value to off
5Click Save and confirm the restart when prompted
6Verify under Overview > Database flags that "remote access" = off

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_sqlserver_remote_access_flag(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            if "SQLSERVER" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "FAIL"
                report.status_extended = f"SQL Server Instance {instance.name} has 'remote access' flag set to 'on'."
                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "remote access"
                        and flag.get("value", "on") != "on"
                    ):
                        report.status = "PASS"
                        report.status_extended = f"SQL Server Instance {instance.name} does not have 'remote access' flag set to 'on'."
                        break
                findings.append(report)

        return findings

References