> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # SQL Instances Should Not Be Configured with Barred Usernames ### More Info: Ensure that SQL Instances are not configured with Barred Usernames ### Risk Level Low ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration "SQL Instances Should Not Be Configured with Barred Usernames" in GCP using GCP console, follow these steps: 1. Open the Google Cloud Console and select the project where the SQL instance is located. 2. In the left navigation menu, select SQL. 3. Select the SQL instance that you want to remediate. 4. In the SQL instance details page, click on the "Users" tab. 5. Review the list of users and check if there are any barred usernames (e.g., root, admin, etc.). 6. If there are any barred usernames, click on the username to select it. 7. Click on the "Delete" button to remove the user from the SQL instance. 8. Repeat steps 6 and 7 for all barred usernames. 9. Once all barred usernames have been removed, click on the "Add user account" button to create a new user account with a strong password. 10. Follow the prompts to create a new user account, ensuring that the username and password meet the recommended security standards. 11. Once the new user account has been created, click on the "Done" button to save the changes. By following these steps, you will have successfully remediated the misconfiguration "SQL Instances Should Not Be Configured with Barred Usernames" in GCP using GCP console. # To remediate the misconfiguration of SQL instances being configured with barred usernames in GCP using GCP CLI, follow these steps: 1. Open the Google Cloud Console and select the project where the SQL instance is located. 2. Open the Cloud Shell by clicking on the icon on the top right corner of the console. 3. In the Cloud Shell, run the following command to list all the SQL instances in the project: `gcloud sql instances list` 4. Identify the SQL instance that is configured with barred usernames. 5. Run the following command to update the instance: `gcloud sql instances patch INSTANCE_NAME --database-flags=ignore_builtin_usernames=USER1,USER2` Replace INSTANCE\_NAME with the name of the SQL instance that you identified in step 4. Replace USER1,USER2 with the list of barred usernames that you want to ignore. You can add more usernames to the list by separating them with a comma. 6. Verify that the configuration has been updated by running the following command: `gcloud sql instances describe INSTANCE_NAME` 7. Check the output for the ignore\_builtin\_usernames flag and verify that the barred usernames have been added to the list. 8. Repeat the above steps for all the SQL instances in the project that are configured with barred usernames. By following these steps, you can remediate the misconfiguration of SQL instances being configured with barred usernames in GCP using GCP CLI. To remediate the SQL Instances Should Not Be Configured with Barred Usernames misconfiguration for GCP using Python, follow these steps: 1. First, you need to identify the SQL instances that are configured with barred usernames. You can use the GCP Python Client Library to list all the SQL instances in your project and check if any of them are configured with barred usernames. Here is an example code snippet to list all the SQL instances in your GCP project: ``` from google.cloud import sql_v1beta4 from google.oauth2 import service_account credentials = service_account.Credentials.from_service_account_file('path/to/credentials.json') client = sql_v1beta4.CloudSqlInstancesServiceClient(credentials=credentials) project_id = 'your-project-id' instances = client.list(project_id=project_id) ``` 2. Once you have identified the SQL instances that are configured with barred usernames, you need to update their configurations to remove the barred usernames. You can use the `patch` method of the `CloudSqlInstancesServiceClient` to update the instance configuration. Here is an example code snippet to update the configuration of a SQL instance: ``` instance_name = 'your-instance-name' instance = client.get(instance_name) settings = instance.settings if 'barred_usernames' in settings: del settings['barred_usernames'] update_mask = {'paths': ['settings']} update_request = {'instance': {'settings': settings}, 'update_mask': update_mask} operation = client.patch(instance_name, update_request) operation.result() ``` This code snippet will remove the `barred_usernames` from the instance settings and update the instance configuration. 3. Finally, you need to verify that the SQL instances are no longer configured with barred usernames. You can use the same code snippet from step 1 to list all the SQL instances and check their configurations. By following these steps, you can remediate the SQL Instances Should Not Be Configured with Barred Usernames misconfiguration for GCP using Python. ```hcl theme={null} # Example: ensure barred usernames are NOT present as Cloud SQL users. # Replace BARRED_USERNAMES and ALLOWED_DB_USER with values from your org policy. # Cloud SQL instance (for context) resource "google_sql_database_instance" "this" { name = "INSTANCE_NAME" # replace with your instance name database_version = "POSTGRES_15" # or MYSQL_X / SQLSERVER_X region = "REGION" # e.g. us-central1 settings { tier = "db-custom-2-7680" } } # REMOVE or RENAME any user resources whose `name` is in your barred list. # Example of a corrected user (previously a barred username): resource "google_sql_user" "allowed_user" { instance = google_sql_database_instance.this.name name = "ALLOWED_DB_USER" # replace with an approved username password = "SECURE_PASSWORD" # or use a secret reference } # Any user with a barred username should be removed from Terraform, # or its `name` changed to a compliant value. For example, if this existed: # # resource "google_sql_user" "barred_user" { # instance = google_sql_database_instance.this.name # name = "BARRED_USERNAME" # on your org's barred list # password = "SECURE_PASSWORD" # } # # You must delete this block, or change `name` to a non-barred username. # Renaming the user forces replacement of the DB user account (drop + recreate). ``` Changing the `name` of a `google_sql_user` forces replacement of that database user (the old user is dropped and a new one created), which can break applications that depend on it; plan carefully before applying. After updating Terraform so that no `google_sql_user` on the instance uses a barred username, `terraform plan` should show the barred users being destroyed (or replaced with new names) and no new users created with barred usernames.