Back to Checks
gcp

Cloud SQL SQL Server instance has the 'user connections' database flag set to 0

cloudsql_instance_sqlserver_user_connections_flag
Service: cloudsqlSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL for SQL Server instances are evaluated to ensure the user connections database flag is set to 0 (unlimited), avoiding any artificial cap on concurrent user sessions

Prowler logoProwlerprowler-provider-gcp

Risk

A capped user connections value can exhaust available sessions, causing login failures, aborted transactions, and timeouts. This reduces availability, can delay administrative access, and may lead to integrity issues from failed or inconsistent retries under load.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_sqlserver_user_connections_flag

Recommendation

Set user connections to 0 to prevent artificial limits. Preserve availability with connection pooling, controlled retries, and capacity planning based on peak usage. If a cap is required, size it with ample headroom, monitor connection counts, and review regularly.

Remediation

CLI

gcloud sql instances patch <example_resource_name> --database-flags='"user connections"=0'

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<region>"
  database_version = "SQLSERVER_2019_STANDARD"

  settings {
    tier = "db-custom-1-3840"

    # Critical: ensure the 'user connections' flag is set to 0 to pass the check
    database_flags {
      name  = "user connections"  # Critical line: target flag
      value = "0"                 # Critical line: set to 0
    }
  }
}

Other

1In Google Cloud Console, go to Cloud SQL > Instances
2Open the SQL Server instance <example_resource_name> and click Edit
3In Database flags, click Add item, select "user connections", set value to 0
4Click Save (the instance may restart)

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_sqlserver_user_connections_flag(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            if "SQLSERVER" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "PASS"
                report.status_extended = f"SQL Server Instance {instance.name} has 'user connections' flag set to '0'."

                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "user connections"
                        and flag.get("value", "0") != "0"
                    ):
                        report.status = "FAIL"
                        report.status_extended = f"SQL Server Instance {instance.name} does not have 'user connections' flag set to '0'."
                        break
                findings.append(report)

        return findings

References