Policy Packs

guardrails-samples

This section covers security recommendations to follow to secure Cloud SQL database services.

GCP CIS v2.0.0 - Section 6 - Cloud SQL Database Services

main

gcp_sql_instance_approved

Determine the action to take when a GCP SQL instance is not approved based on `GCP &gt; SQL &gt; Instance &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

instanceApproved

GCP > SQL > Instance > Approved

gcp_sql_instance_approved_custom

Determine whether the GCP SQL instance is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If a GCP SQL instance is not approved, it will be subject to the action specified in the `GCP &gt; SQL &gt; Instance &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

instanceApprovedCustom

GCP > SQL > Instance > Approved > Custom

gcp_sql_instance_authorized_network_approved

Configure Authorized Network setting for `GCP &gt; SQL &gt; Instance` to whitelist specific IP ranges.&#92;n&#92;nIf set to `Enforce: Delete unapproved`, any unapproved IP&#39;s will be revoked from the authorized network block.&#92;n

instanceAuthorizedNetworkApproved

GCP > SQL > Instance > Authorized Network > Approved

gcp_sql_instance_authorized_network_approved_cidr_ranges

Configure the instance to allow access from approved CIDR ranges.&#92;n&#92;nProvide allowed internet address ranges using CIDR notation in the form 16.17.18.0/24 or as individual IP addresses like 16.17.18.19. All CIDR ranges are approved (`*`) by default.&#92;n Examples:&#92;n   - 199.27.25.0/24&#92;n   - 200.27.123.0/24&#92;n   - 28.0.0.8&#92;n

instanceAuthorizedNetworkApprovedCidrRanges

GCP > SQL > Instance > Authorized Network > Approved > CIDR Ranges

gcp_sql_instance_data_protection_managed_backups

Guardrails can automate taking SQL backups and manage the retention of these backups.&#92;n&#92;nThis policy enables / disables that feature, enforcing the schedule in the&#92;n`Managed Backups &gt; Schedule` and `Managed Backups &gt; Minimum Schedule` sub-policies.&#92;n

instanceDataProtectionManagedBackups

GCP > SQL > Instance > Data Protection > Managed Backups

gcp_sql_instance_data_protection_managed_backups_minimum_schedule

A minimum level of backups to be taken and retained. Use this policy to set a&#92;nminimum level of data protection, while allowing application teams flexibility&#92;nto expand backups using `Managed Backups &gt; Schedule`&#92;n

instanceDataProtectionMinimumSchedule

GCP > SQL > Instance > Data Protection > Managed Backups > Minimum Schedule

gcp_sql_instance_data_protection_managed_backups_schedule

Backups will be taken and retained according to this schedule. Note that&#92;n`Managed Backups &gt; Minimum Schedule` can be used to set a minimum level of backup,&#92;nregardless of this policy setting..&#92;n

instanceDataProtectionSchedule

GCP > SQL > Instance > Data Protection > Managed Backups > Schedule

gcp_sql_instance_database_flags

Configure whether Database Flags setting is enabled for Cloud SQL Database Services.&#92;n&#92;nDatabase flags are configurable parameters that allow to customize the behavior and performance of the Cloud SQL instance. These flags can be used to set various database engine options, such as enabling or disabling specific features, tuning performance settings, or adjusting the default behavior of the database.&#92;nChanges to database flags usually require a restart of the instance to take effect.&#92;n

instanceDatabaseFlags

GCP > SQL > Instance > Database Flags

gcp_sql_instance_database_flags_mysql_template

The template is used to generate the keys and values for database flags under GCP SQL instance.&#92;n&#92;nDatabase flags are configurable parameters that allow to customize the behavior and performance of the Cloud SQL instance. These flags can be used to set various database engine options, such as enabling or disabling specific features, tuning performance settings, or adjusting the default behavior of the database.&#92;nChanges to database flags usually require a restart of the instance to take effect.&#92;n&#92;nFlags not defined in SQL Instance Databse Flags Template will not be modified or deleted. Setting a flag value to `undefined` or `null` will result in the flag being deleted.&#92;n&#92;nSample flags supported for MySQL DB engine:&#92;n&#92;n**MySQL:**&#92;n```&#92;n  skip_show_database: on&#92;n  local_infile: off&#92;n```&#92;n&#92;nSee [MySQL database flags](https://cloud.google.com/sql/docs/mysql/flags) for more information.&#92;n

instanceMysqlDatabaseFlagsTemplate

GCP > SQL > Instance > Database Flags > MySQL > Template

gcp_sql_instance_database_flags_postgresql_template

The template is used to generate the keys and values for database flags under GCP SQL instance.&#92;n&#92;nDatabase flags are configurable parameters that allow to customize the behavior and performance of the Cloud SQL instance. These flags can be used to set various database engine options, such as enabling or disabling specific features, tuning performance settings, or adjusting the default behavior of the database.&#92;nChanges to database flags usually require a restart of the instance to take effect.&#92;n&#92;nFlags not defined in SQL Instance Databse Flags Template will not be modified or deleted. Setting a flag value to `undefined` or `null` will result in the flag being deleted.&#92;n&#92;nSample flags supported for PostgreSQL DB engine:&#92;n&#92;n**PostgreSQL:**&#92;n```&#92;n  log_error_verbosity: default&#92;n  log_connections: on&#92;n  log_disconnections: on&#92;n  log_statement: ddl&#92;n  log_min_messages: log&#92;n  log_min_error_statement: panic&#92;n  log_min_duration_statement: -1&#92;n  cloudsql.enable_pgaudit: on&#92;n```&#92;n&#92;nSee [PostgreSQL database flags](https://cloud.google.com/sql/docs/postgres/flags) for more information.&#92;n

instancePostgresqlDatabaseFlagsTemplate

GCP > SQL > Instance > Database Flags > PostgreSQL > Template

gcp_sql_instance_database_flags_sql_server_template

The template is used to generate the keys and values for database flags under GCP SQL instance.&#92;n&#92;nDatabase flags are configurable parameters that allow to customize the behavior and performance of the Cloud SQL instance. These flags can be used to set various database engine options, such as enabling or disabling specific features, tuning performance settings, or adjusting the default behavior of the database.&#92;nChanges to database flags usually require a restart of the instance to take effect.&#92;n&#92;nFlags not defined in SQL Instance Databse Flags Template will not be modified or deleted. Setting a flag value to `undefined` or `null` will result in the flag being deleted.&#92;n&#92;nSample flags supported for SQL Server DB engine:&#92;n&#92;n**SQL Server:**&#92;n```&#92;n  external scripts enabled: off&#92;n  cross db ownership chaining: off&#92;n  user connections: 10&#92;n  user options: 2&#92;n  remote access: off&#92;n  3625: on&#92;n  contained database authentication: off&#92;n```&#92;n&#92;nSee [SQL Server database flags](https://cloud.google.com/sql/docs/sqlserver/flags) for more information.&#92;n&#92;n**Note:** `cross db ownership chaining` flag is deprecated for all SQL Server versions. Going forward, you can&#39;t set its value to on. However, if you have this flag enabled, we strongly recommend that you either remove the flag from your database or set it to `off`.&#92;n

instanceSqlDatabaseFlagsTemplate

GCP > SQL > Instance > Database Flags > SQL Server > Template

gcp_sql_instance_encryption_in_transit

Define the Encryption in Transit settings required for `GCP &gt; SQL &gt; Instance`.&#92;n&#92;nThe Encryption in Transit control compares the Encryption in Transit settings against the Encryption in Transit policies for the resource (GCP &gt; SQL &gt; Instance &gt; Encryption In Transit), raises an alarm, and takes the defined enforcement action.&#92;n&#92;n**Note:** SQL Server type instances does not support `trusted client certificate`.&#92;n

Policy	Setting	Note
GCP > SQL > Instance > Approved	Check: Approved	GCP CIS v2.0.0 - Control: 6.2.9
GCP > SQL > Instance > Approved > Custom	Calculated	GCP CIS v2.0.0 - Control: 6.2.9
GCP > SQL > Instance > Authorized Network > Approved	Check: Approved	GCP CIS v2.0.0 - Control: 6.5
GCP > SQL > Instance > Authorized Network > Approved > CIDR Ranges	- "10.2.1.2/24" - "172.141.23.22/26"	GCP CIS v2.0.0 - Control: 6.5
GCP > SQL > Instance > Data Protection > Managed Backups	Skip	GCP CIS v2.0.0 - Control: 6.7
GCP > SQL > Instance > Data Protection > Managed Backups > Minimum Schedule	Enforce: Daily for 30 days	GCP CIS v2.0.0 - Control: 6.7
GCP > SQL > Instance > Data Protection > Managed Backups > Schedule	Enforce: Daily for 30 days	GCP CIS v2.0.0 - Control: 6.7
GCP > SQL > Instance > Database Flags	Check: Database flags are correct	GCP CIS v2.0.0 - Control: 6.1.2, 6.1.3, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6 and 6.3.7
GCP > SQL > Instance > Database Flags > MySQL > Template	{ "skip_show_database": "on", "local_infile": "off" }	GCP CIS v2.0.0 - Control: 6.1.2 and 6.1.3
GCP > SQL > Instance > Database Flags > PostgreSQL > Template	{ "log_error_verbosity": "default", "log_connections": "on", "log_disconnections": "on", "log_statement": "ddl", "log_min_messages": "log", "log_min_error_statement": "panic", "log_min_duration_statement": -1, "cloudsql.enable_pgaudit": "on" }	GCP CIS v2.0.0 - Control: 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7 and 6.2.8
GCP > SQL > Instance > Database Flags > SQL Server > Template	{ "3625": "on", "external scripts enabled": "off", "cross db ownership chaining": "off", "user connections": 10, "user options": 2, "remote access": "off", "contained database authentication": "off" }	GCP CIS v2.0.0 - Control: 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6 and 6.3.7
GCP > SQL > Instance > Encryption In Transit	Check: Enabled	GCP CIS v2.0.0 - Control: 6.4

Policy Settings