Back to Checks
gcp

Cloud SQL for SQL Server instance has trace flag 3625 set to 'on'

cloudsql_instance_sqlserver_trace_flag
Service: cloudsqlSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL for SQL Server instances have the 3625 (trace flag) database flag set to on

Prowler logoProwlerprowler-provider-gcp

Risk

Without 3625 enabled, SQL errors can reveal parameters and object names to non-admins, weakening confidentiality and aiding targeted injection, account enumeration, and data discovery. Leaked context helps craft exploits and pivot attacks, ultimately risking data integrity and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_sqlserver_trace_flag

Recommendation

Set trace flag 3625 to on for all SQL Server instances in Cloud SQL to limit error details for non-admins. Apply least privilege, practice defense in depth with application-level error handling, and centralize diagnostics in logs rather than returning verbose messages to clients.

Remediation

CLI

gcloud sql instances patch <INSTANCE_NAME> --database-flags=3625=on

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<example_region>"
  database_version = "SQLSERVER_2019_STANDARD"

  settings {
    tier = "<example_tier>"

    # Critical: enable SQL Server trace flag 3625
    # This sets the flag to 'on' so the check passes
    database_flags {
      name  = "3625"
      value = "on"
    }
  }
}

Other

1In Google Cloud Console, go to Cloud SQL > Instances and open <INSTANCE_NAME>
2Click Edit
3In Flags, click Add item
4Select 3625 (trace flag) and set value to on
5Click Save and confirm the restart

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_sqlserver_trace_flag(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            if "SQLSERVER" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "FAIL"
                report.status_extended = f"SQL Server Instance {instance.name} has '3625 (trace flag)' flag set to 'off'."

                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "3625"
                        and flag.get("value", "off") == "on"
                    ):
                        report.status = "PASS"
                        report.status_extended = f"SQL Server Instance {instance.name} has '3625 (trace flag)' flag set to 'on'."
                        break
                findings.append(report)

        return findings

References