More Info:
Determine if the SQL instances provisioned in the account are only of the type desired by the organization and nothing else.Risk Level
MediumAddress
Operational MaturityCompliance Standards
CBPTriage and Remediation
- Remediation
Remediation
Using Console
Using Console
The following are the step-by-step instructions to remediate the misconfiguration “Determine SQL Instances Provisioned are of Desired Type” for GCP using GCP console:
- Open the Google Cloud Console and navigate to the SQL Instances page.
- Identify the SQL instances that are not of the desired type.
- Click on the name of the SQL instance that needs to be remediated.
- In the Instance details page, click on the Edit button at the top of the page.
- In the Edit page, scroll down to the Configuration Options section.
- In the Configuration Options section, select the desired SQL type from the drop-down menu.
- Click on the Save button at the bottom of the page to save the changes.
- Repeat the above steps for all the SQL instances that are not of the desired type.
- Verify that all the SQL instances are now of the desired type by checking the Instance details page for each SQL instance.
Using CLI
Using CLI
The first step in remediating this misconfiguration is to identify all the SQL instances that are currently provisioned in your GCP environment and verify that they are of the desired type. Follow these steps to remediate this issue using the GCP CLI:
- Open the Cloud Shell in your GCP account.
-
Run the following command to list all the SQL instances in your project:
- Review the output from the above command to identify the SQL instances that are currently provisioned in your project.
-
Run the following command to describe a specific SQL instance:
Replace INSTANCE_NAME with the name of the SQL instance that you want to describe.
- Review the output from the above command to verify that the SQL instance is of the desired type.
-
Run the following command to create a new SQL instance:
Replace NEW_INSTANCE_NAME with a unique name for the new SQL instance, TIER with the desired tier (e.g. db-n1-standard-2) and REGION with the desired region (e.g. us-central1).
-
Run the following command to set the root password for the new SQL instance:
Replace NEW_INSTANCE_NAME with the name of the new SQL instance and NEW_PASSWORD with a strong password for the root user.
-
Run the following command to create a new database in the new SQL instance:
Replace NEW_INSTANCE_NAME with the name of the new SQL instance and NEW_DATABASE_NAME with a unique name for the new database.
-
Finally, you will need to migrate your data from the old SQL instance to the new SQL instance. You can use the Cloud SQL Admin API or a third-party tool to perform the migration. Once the migration is complete, you can delete the old SQL instance using the following command:
Replace OLD_INSTANCE_NAME with the name of the old SQL instance.
Using Python
Using Python
The misconfiguration “Determine SQL Instances Provisioned are of Desired Type” in GCP can be remediated using the following steps in Python:Note: Make sure to replace ‘path/to/key.json’, ‘your-project-id’, ‘your-instance-name’, ‘MYSQL_5_7’, and ‘POSTGRES_9_6’ with the correct values for your environment.
- Import the necessary libraries:
- Create a service account and authenticate using the JSON key file:
- Set the project ID and create a BigQuery client:
- Define the query to check for SQL instances that are not of the desired type:
- Run the query and check the results:
- If there are instances that are not of the desired type, you can update them using the Cloud SQL API:

