1. Login to your GCP console.
2. Navigate to the Cloud SQL Instances page.
3. Select the instance for which you want to remediate the misconfiguration.
4. Click on the “Edit” button at the top of the page.
5. Scroll down to the “Encryption” section.
6. Under the “Encryption in transit” section, select “Require SSL” option.
7. Under the “Encryption at rest” section, select “Customer-managed encryption key” option.
8. Provide the required details for Customer-managed encryption key, such as key name, key version and key location.
9. Click on the “Save” button to save the changes.
10. Verify the changes by checking the “Encryption” section on the Cloud SQL instance page.

​

1. Open the Google Cloud Shell by clicking on the Activate Cloud Shell button present on the top right corner of the Google Cloud Console.
2. Once you have opened the Google Cloud Shell, run the following command to set the project where you want to remediate the misconfiguration:
   gcloud config set project [PROJECT_ID]
   
   Replace [PROJECT_ID] with the ID of the project where you want to remediate the misconfiguration.
3. Next, run the following command to list all the Cloud SQL instances in the project:
   gcloud sql instances list
   
4. Identify the Cloud SQL instance for which you want to remediate the misconfiguration and note down its name.
5. Run the following command to update the Cloud SQL instance configuration and restrict default Google-managed encryption:
   gcloud sql instances patch [INSTANCE_NAME] --require-ssl --backup-start-time 00:00
   
   Replace [INSTANCE_NAME] with the name of the Cloud SQL instance for which you want to remediate the misconfiguration.
6. After running the above command, the default Google-managed encryption will be restricted for the Cloud SQL instance. Note: The above command also enforces SSL connections and sets the backup start time to 00:00.

1. Import the necessary libraries:

from googleapiclient import discovery
from oauth2client.client import GoogleCredentials

2. Authenticate and authorize the client:

credentials = GoogleCredentials.get_application_default()
service = discovery.build('sqladmin', 'v1beta4', credentials=credentials)

3. Get the list of Cloud SQL instances:

project_id = 'YOUR_PROJECT_ID'
instances = service.instances().list(project=project_id).execute()

4. Iterate over the instances and update the settings:

for instance in instances['items']:
    instance_name = instance['name']
    settings = instance['settings']
    settings['dataDiskEncryptionEnabled'] = True
    settings['dataDiskEncryptionCipher'] = 'AES_256'
    settings['backupConfiguration']['binaryLogEnabled'] = False
    settings['backupConfiguration']['enabled'] = True
    settings['backupConfiguration']['pointInTimeRecoveryEnabled'] = True
    settings['backupConfiguration']['replicationLogArchivingEnabled'] = False
    settings['backupConfiguration']['startTime'] = '00:00'
    settings['backupConfiguration']['transactionLogRetentionDays'] = 7
    settings['ipConfiguration']['authorizedNetworks'] = []
    settings['ipConfiguration']['ipv4Enabled'] = True
    settings['ipConfiguration']['privateNetwork'] = 'default'
    settings['ipConfiguration']['requireSsl'] = True
    settings['locationPreference']['zone'] = 'YOUR_PREFERRED_ZONE'
    settings['maintenanceWindow']['day'] = 1
    settings['maintenanceWindow']['hour'] = 0
    settings['pricingPlan'] = 'PER_USE'
    settings['settingsVersion'] = '1'
    settings['storageAutoResize'] = True
    settings['storageAutoResizeLimit'] = '0'
    settings['tier'] = 'db-n1-standard-1'
    settings['userLabels'] = {}
    request = service.instances().update(project=project_id, instance=instance_name, body={'settings': settings})
    response = request.execute()
    print('Instance {} updated.'.format(instance_name))

5. Save the Python script and run it using the command:

python script_name.py

• Create all Cloud SQL instances with CMEK in Terraform, and
• Use an external control (organization policy if/when Google adds such a constraint, or an out‑of‑band scanner/validator) to detect/deny non‑CMEK instances.