SQL Database instances should only allow ingress traffic from specific IP addresses
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Description
A database server should accept connections only from trusted networks and IPs and
restrict access from public IP addresses.
Rationale
To minimize attack surface on a database server instance, only trusted, known, and
required IPs should be allowed to connect to it.
An authorized network should not have IPs or networks configured to 0.0.0.0/0 which
allows access to the instance from anywhere in the world. Authorized networks
apply only to instances with public IPs.
Impact
The Cloud SQL database instance would not be available to public IP addresses.
From the console
- Go to the Cloud SQL Instances page in the Google Cloud Console by visiting https://console.cloud.google.com/sql/instances.
- Click the instance name to open its
Instance details page. - Under the
Configuration section click Edit configurations. - Under
Configuration options expand the Connectivity section. - Click the
delete icon for the authorized network 0.0.0.0/0. - Click
Save to update the instance.
From the command line
Update the authorized network list by removing addresses:
gcloud sql instances patch <INSTANCE_NAME> --authorized-networks=IP_ADDR1,IP_ADDR2...
Prevention
To prevent new SQL instances from being configured to accept incoming connections from
any IP addresses, set up a Restrict Authorized Networks on Cloud SQL instances Organization Policy at: https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictAuthorizedNetworks.
Default value
By default, authorized networks are not configured. Remote connection to Cloud SQL
database instance is not possible unless authorized networks are configured.
References
- https://cloud.google.com/sql/docs/mysql/configure-ip
- https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictAuthorizedNetworks
- https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
- https://cloud.google.com/sql/docs/mysql/connection-org-policy
There is no IPv6 configuration found for Google cloud SQL server services.
