> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Restrict Authorized Networks on Cloud SQL instances

### More Info:

Ensure that "Restrict Authorized Networks on Cloud SQL instances" policy is enforced for your Google Cloud Platform (GCP) organization to deny IAM members to add authorized networks in order to provide access to your security-critical SQL database instances.

### Risk Level

Medium

### Address

Security, Operational Maturity

### Compliance Standards

CBP

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Restrict Authorized Networks on Cloud SQL instances" misconfiguration on GCP using the GCP console, please follow these steps:

        1. Login to your GCP Console and navigate to the Cloud SQL Instances page.

        2. Select the Cloud SQL instance that you want to remediate.

        3. Click on the "Edit" button at the top of the page.

        4. Scroll down to the "Authorized networks" section.

        5. Click on the "Add network" button.

        6. In the "Network" field, enter the IP address or CIDR range of the network that you want to authorize.

        7. In the "Name" field, enter a name for the network.

        8. Click the "Done" button.

        9. Repeat steps 5-8 for each network that you want to authorize.

        10. Once you have added all the authorized networks, click on the "Save" button at the bottom of the page.

        11. Verify that the authorized networks are restricted and only authorized IP addresses or CIDR ranges can access the Cloud SQL instance.

        By following these steps, you have successfully remediated the "Restrict Authorized Networks on Cloud SQL instances" misconfiguration on GCP using the GCP console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of "Restrict Authorized Networks on Cloud SQL instances" for GCP using GCP CLI, follow these steps:

        Step 1: Open the Google Cloud Console and select the project in which the Cloud SQL instance is located.

        Step 2: Open the Cloud Shell by clicking on the icon in the top right corner of the console.

        Step 3: Run the following command to get a list of all the Cloud SQL instances in the project:

        ```
        gcloud sql instances list
        ```

        Step 4: Identify the Cloud SQL instance that needs to be remediated and run the following command to update the authorized networks:

        ```
        gcloud sql instances patch [INSTANCE_NAME] --authorized-networks [AUTHORIZED_NETWORKS]
        ```

        Replace \[INSTANCE\_NAME] with the name of the Cloud SQL instance and \[AUTHORIZED\_NETWORKS] with the list of authorized networks in CIDR notation. For example, if you want to restrict access to a single IP address, the command would look like this:

        ```
        gcloud sql instances patch my-instance --authorized-networks=192.168.0.1/32
        ```

        Step 5: Verify that the authorized networks have been updated by running the following command:

        ```
        gcloud sql instances describe [INSTANCE_NAME] | grep authorizedNetworks
        ```

        This command will display the updated list of authorized networks for the Cloud SQL instance.

        Step 6: Repeat the above steps for all the Cloud SQL instances in the project that require remediation.

        By following these steps, you can remediate the misconfiguration of "Restrict Authorized Networks on Cloud SQL instances" for GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of unrestricted authorized networks on Cloud SQL instances in GCP using Python, follow these steps:

        1. Import the required libraries:

        ```python theme={null}
        from google.cloud import sql_v1beta4
        from google.oauth2 import service_account
        ```

        2. Set up the credentials for authentication:

        ```python theme={null}
        credentials = service_account.Credentials.from_service_account_file('<path_to_service_account_file>')
        ```

        3. Set up the Cloud SQL client:

        ```python theme={null}
        client = sql_v1beta4.CloudSqlInstancesServiceClient(credentials=credentials)
        ```

        4. Get the instance you want to remediate:

        ```python theme={null}
        instance_name = '<instance_name>'
        project_id = '<project_id>'
        instance = client.get(project_id=project_id, instance=instance_name)
        ```

        5. Get the current authorized networks:

        ```python theme={null}
        current_settings = instance.settings
        current_networks = current_settings.ip_configuration.authorized_networks
        ```

        6. Remove any unrestricted authorized networks:

        ```python theme={null}
        new_networks = [network for network in current_networks if network.value != '0.0.0.0/0']
        ```

        7. Update the instance with the new authorized networks:

        ```python theme={null}
        new_settings = sql_v1beta4.Settings(ip_configuration=sql_v1beta4.IpConfiguration(authorized_networks=new_networks))
        update_mask = sql_v1beta4.field_mask.FieldMask(paths=['settings.ip_configuration.authorized_networks'])
        update_request = sql_v1beta4.SqlInstancesUpdateRequest(instance=instance, settings=new_settings, update_mask=update_mask)
        client.update(update_request=update_request)
        ```

        This will remove any unrestricted authorized networks from the Cloud SQL instance's IP configuration and update the instance with the new settings.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>