GCP CloudSql Audit - Security Checks
Checks Performed
- Automated Backups Should Be Enabled
- Cross DB Ownership Chaining Should Be Disabled
- Database Authentication Flag Should Be Disabled
- Database Instances Should Not Have Public IPs
- Database SSL Certificate Should Be Rotated After Every 90 Days
- Databases Should Have SSL
- DB Instances Should Not Be Publicly Accessible
- Determine SQL Instances Provisioned are of Desired Type
- Instances Should Be Multi AZ
- Minimum Number of SQL Backups To Be Retained
- MySQL Local Infile Flag Should Be Disabled
- MySQL Skip Show Database Flag Should Be On
- Point In Time Restore Should Be Enabled
- PostgreSQL Enable PGAudit Database Flag Should Be On
- PostgreSQL External Scripts Enabled Flag Should Be Off
- PostgreSQL Instance IP Assignment Set To Private
- PostgreSQL Log Checkpoints Flag Should Be Disabled
- PostgreSQL Log Connections Flag Should Be On
- PostgreSQL Log Disconnections Flag Should Be Disabled
- PostgreSQL Log Error Verbosity Flag Should Be DEFAULT Or Stricter
- PostgreSQL Log Executor Stats Flag Should Be Off
- PostgreSQL Log Hostname Flag Should Be On
- PostgreSQL Log Lock Waits Flag Should Be Disabled
- PostgreSQL Log Min Duration Statement Flag Should Be -1
- PostgreSQL Log Min Error Statement Flag Should Be Error Or Stricter
- PostgreSQL Log Min Messages Flag Should Be Disabled
- PostgreSQL Log Parser Stats Flag Should Be Off
- PostgreSQL Log Planner Stats Flag Should Be Off
- PostgreSQL Log Statement Flag Should Be Set Appropriately
- PostgreSQL Log Statement Stats Flag Should Be Set Appropriately
- PostgreSQL Log Temp Files Flag Should Be 0
- Provisioned Instances Should Not Exceed Set Threshold
- Read Replica Instances Should Not Be public
- Root User Should Not Be Accessible From Any Host
- SQL Backup Configuration Should Be Enabled
- SQL Instance Should Have Backend Type Second Generation
- SQL Instances Should Be Configured with the Latest SQL Versions
- SQL Instances Should Be Encrypted Using Customer Managed Keys (CMKs)
- SQL Instances Should Have Binary Logging Enabled
- SQL Instances Should Have Maintenance Scheduled Within the Next 30 Day
- SQL Instances should have Storage Auto Resize Enabled
- SQL Instances Should Not Be Configured with Barred Usernames
- SQL Query Insights should be Enabled
- SQL Read Replica Instances Should Be Encrypted Using Customer Managed Keys (CMKs)
- SQL Server Remove Access Flag Should Be Off
- SQL Server Trace Flag Should Be Off
- SQL Server User Connections Flag Should Be A Non-Limiting Value
- SQL Server User Options Flag Should Not Be Configured