> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Open mysql remediation ### Triage and Remediation ### Remediation To remediate the MySQL port open misconfiguration on GCP using the GCP console, please follow the below steps: 1. Log in to the GCP Console ([https://console.cloud.google.com/](https://console.cloud.google.com/)). 2. Navigate to the GCP project that has the misconfigured MySQL port. 3. In the navigation menu, click on "Compute Engine". 4. Select the VM instance that has the open MySQL port. 5. Click on the "Edit" button at the top of the page. 6. Scroll down to the "Firewall" section and click on "Networking". 7. Under the "Firewall rules" section, click on "default-allow-mysql". 8. Click on the "Delete" button to remove the rule. 9. Click on the "Save" button at the bottom of the page to apply the changes. By following the above steps, you have successfully remediated the MySQL port open misconfiguration on GCP. # To remediate the MySQL port being open on GCP using GCP CLI, follow these steps: 1. Open the GCP Console and go to the Cloud Shell. 2. Run the following command to list all the instances in your project: `gcloud compute instances list` 3. Identify the instance that has the open MySQL port. 4. Run the following command to SSH into the instance: `gcloud compute ssh [INSTANCE_NAME]` Replace `[INSTANCE_NAME]` with the name of the instance that you identified in step 3. 5. Once you are logged in to the instance, run the following command to edit the `mysqld.cnf` file: `sudo nano /etc/mysql/mysql.conf.d/mysqld.cnf` 6. Look for the following line in the file: `bind-address = 0.0.0.0` 7. Comment out this line by adding a `#` at the beginning of the line: `# bind-address = 0.0.0.0` 8. Save the changes and exit the file. 9. Restart the MySQL service by running the following command: `sudo service mysql restart` 10. Exit the SSH session by running the following command: `exit` With these steps, you have successfully remediated the MySQL port being open on your GCP instance using GCP CLI. To remediate the MySQL Port open misconfiguration in GCP using Python, you can follow the below steps: 1. Import the necessary libraries: ```python theme={null} from google.cloud import compute_v1 import google.auth ``` 2. Authenticate and create a client object: ```python theme={null} creds, project = google.auth.default() compute_client = compute_v1.ComputeClient(credentials=creds) ``` 3. Define the project and zone where the instance is located: ```python theme={null} project = 'your-project-id' zone = 'us-central1-a' ``` 4. Define the instance name and the network tag associated with the instance: ```python theme={null} instance_name = 'your-instance-name' network_tag = 'your-network-tag' ``` 5. Get the instance details using the `get` method: ```python theme={null} instance = compute_client.instances().get(project=project, zone=zone, instance=instance_name).execute() ``` 6. Check if the MySQL port is open by looking at the instance's network tags: ```python theme={null} if network_tag in instance['tags']['items']: if '3306' in instance['metadata']['items'][0]['value']: print('MySQL port is open') ``` 7. If the MySQL port is open, remove it from the instance's metadata: ```python theme={null} metadata = instance['metadata'] items = metadata['items'] new_items = [] for item in items: if item['key'] == 'gce-container-declaration': container = json.loads(item['value']) ports = container['ports'] new_ports = [] for port in ports: if port['containerPort'] != 3306: new_ports.append(port) container['ports'] = new_ports item['value'] = json.dumps(container) new_items.append(item) metadata['items'] = new_items compute_client.instances().update(project=project, zone=zone, instance=instance_name, body={'metadata': metadata}).execute() ``` This will remove the MySQL port from the instance's metadata, effectively closing the port. ```hcl theme={null} resource "google_compute_firewall" "mysql_restricted" { name = "mysql-restricted" network = google_compute_network.VPC_NETWORK_NAME.self_link project = "GCP_PROJECT_ID" direction = "INGRESS" # Allow MySQL ports ONLY from approved IP ranges source_ranges = [ "OFFICE_CIDR_BLOCK", # e.g. "203.0.113.0/24" "BASTION_HOST_IP/32", # e.g. "198.51.100.10/32" ] allows { protocol = "tcp" ports = ["3306", "4333"] } # Optionally restrict by target tags or service accounts # target_tags = ["mysql-server"] # target_service_accounts = ["MYSQL_SERVER_SA@GCP_PROJECT_ID.iam.gserviceaccount.com"] description = "Restrict MySQL ports 3306 and 4333 to known IP addresses" } ``` Substitute: * `VPC_NETWORK_NAME` with the Terraform resource name or your existing network (`google_compute_network.main`, etc.). * `GCP_PROJECT_ID` with your project ID. * `OFFICE_CIDR_BLOCK`/`BASTION_HOST_IP/32` with the specific trusted CIDR blocks/IPs that are allowed to reach MySQL. If you currently have a `google_compute_firewall` rule on this network that: * has `allows` covering `tcp` ports `3306`/`4333`, and * uses `source_ranges = ["0.0.0.0/0"]` (or other overly broad ranges), update that existing resource’s `source_ranges` to the restricted list above (or split out a dedicated rule for MySQL and remove those ports from any public rule). This change is in-place and does not force replacement of the firewall rule. For verification, `terraform plan` should show the existing firewall rule’s `source_ranges` changing from `["0.0.0.0/0"]` (or other broad ranges) to the specific trusted CIDR blocks, and no other attributes of the rule should change.