> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Sql external scripts enabled flag remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the PostgreSQL External Scripts Enabled Flag Should Be Off misconfiguration for GCP using GCP console, follow these steps:

        1. Open the GCP Console and navigate to the Cloud SQL instances page.
        2. Select the PostgreSQL instance you want to remediate.
        3. Click on the "Edit" button at the top of the page.
        4. Scroll down to the "Flags" section.
        5. Locate the "external-scripts-enabled" flag and set it to "off".
        6. Click on the "Save" button at the bottom of the page to save the changes.

        After completing these steps, the PostgreSQL External Scripts Enabled Flag will be turned off, and the misconfiguration will be remediated.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the PostgreSQL External Scripts Enabled Flag misconfiguration for GCP using GCP CLI, you can follow the below steps:

        1. Open the Cloud Shell in your GCP console.

        2. Run the following command to list all the Cloud SQL instances in your GCP project:

           ```
           gcloud sql instances list
           ```

        3. Identify the instance for which you want to remediate the PostgreSQL External Scripts Enabled Flag misconfiguration.

        4. Run the following command to update the instance configuration:

           ```
           gcloud sql instances patch [INSTANCE_NAME] --database-flags=external_scripting=false
           ```

           Replace \[INSTANCE\_NAME] with the name of your Cloud SQL instance.

        5. Confirm the update by running the following command:

           ```
           gcloud sql instances describe [INSTANCE_NAME]
           ```

           This will display the details of your Cloud SQL instance, including the updated configuration.

        By following these steps, you can remediate the PostgreSQL External Scripts Enabled Flag misconfiguration for GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the PostgreSQL External Scripts Enabled Flag misconfiguration on GCP using Python, you can follow the below steps:

        1. Connect to the GCP project using the `google-auth` and `google-cloud-secret-manager` libraries.

        ```python theme={null}
        from google.auth import credentials
        from google.cloud import secretmanager

        # Set up credentials
        credentials, project_id = google.auth.default()
        client = secretmanager.SecretManagerServiceClient(credentials=credentials)
        ```

        2. Retrieve the PostgreSQL instance name and configuration details from the GCP Secret Manager.

        ```python theme={null}
        # Retrieve PostgreSQL instance name and configuration details from Secret Manager
        name = "projects/{project_id}/secrets/{secret_name}/versions/latest".format(
            project_id=project_id,
            secret_name="postgres-config"
        )
        response = client.access_secret_version(name=name)
        config = json.loads(response.payload.data.decode("UTF-8"))
        ```

        3. Connect to the PostgreSQL instance using the `psycopg2` library.

        ```python theme={null}
        import psycopg2

        # Connect to PostgreSQL instance
        conn = psycopg2.connect(
            host=config["host"],
            port=config["port"],
            dbname=config["dbname"],
            user=config["user"],
            password=config["password"]
        )
        ```

        4. Disable the External Scripts Enabled flag by updating the `postgresql.conf` file.

        ```python theme={null}
        # Disable External Scripts Enabled flag
        with conn.cursor() as cursor:
            cursor.execute("ALTER SYSTEM SET external_scripts_enabled TO off;")
            conn.commit()
        ```

        5. Restart the PostgreSQL instance for the changes to take effect.

        ```python theme={null}
        # Restart PostgreSQL instance
        with conn.cursor() as cursor:
            cursor.execute("SELECT pg_reload_conf();")
            conn.commit()
        ```

        By following these steps, you can remediate the PostgreSQL External Scripts Enabled Flag misconfiguration on GCP using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        For `gcp-database-sql-instance` (Google Cloud SQL for PostgreSQL), this finding cannot be remediated in Terraform because the `external scripts enabled` flag is specific to Microsoft SQL Server and does not exist as a configurable setting on Cloud SQL for PostgreSQL.

        There is no equivalent database flag or instance setting in the `google_sql_database_instance` resource (or any related Cloud SQL Terraform resource) that maps to SQL Server’s `external scripts enabled` option, either in Terraform or in the GCP Console, so no HCL change is possible or required. This rule is effectively not applicable to Cloud SQL for PostgreSQL.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>