Detections
Analytics

6.2.9 Ensure Instance IP assignment is set to private

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Instance addresses can be public IP or private IP. Public IP means that the instance is accessible through the public internet. In contrast, instances using only private IP are not accessible through the public internet, but are accessible through a Virtual Private Cloud (VPC).

Limiting network access to your database will limit potential attacks.

Rationale:

Setting databases access only to private will reduce attack surface.

Impact:

If you set a database IP to private, only host from the same network will have the ability to connect your database.

Configuring an existing Cloud SQL instance to use private IP causes the instance to restart.

Solution

From Google Cloud Console

In the Google Cloud console, go to the Cloud SQL Instances page.

Open the Overview page of an instance by clicking the instance name.

Select Connections from the SQL navigation menu.

Check the Private IP checkbox. A drop-down list shows the available networks in your project.

Select the VPC network you want to use:
If you see Private service connection required:

Click Set up connection.

In the Allocate an IP range section, choose one of the following options:

Select one or more existing IP ranges or create a new one from the dropdown. The dropdown includes previously allocated ranges, if there are any, or you can select Allocate a new IP range and enter a new range and name.

Use an automatically allocated IP range in your network.
Note: You can specify an address range only for a primary instance, not for a read replica or clone.

Click Continue.

Click Create connection.

Verify that you see the Private service connection for network VPC_NETWORK_NAME has been successfully created status.

[Optional step for Private Services Access - review reference links to VPC documents for additional detail] If you want to allow other Google Cloud services such as BigQuery to access data in Cloud SQL and make queries against this data over a private IP connection, then select the Private path for Google Cloud services check box.

Click Save

From Google Cloud CLI

List cloud SQL instances

gcloud sql instances list --format="json" | jq '.[] | .connectionName,.ipAddresses'

Note the project name of the instance you want to set to a private IP, this will be <PROJECT_ID>
Note the instance name of the instance you want to set to a private IP, this will be <INSTANCE_ID>
Example public instance output:

"my-project-123456:us-central1:my-instance"
[
 {
 "ipAddress": "0.0.0.0",
 "type": "PRIMARY"
 },
 {
 "ipAddress": "0.0.0.0",
 "type": "OUTGOING"
 }

run the following command to list the available VPCs

gcloud compute networks list --format="json" | jq '.[].name'

Note the name of the VPC to use for the instance private IP, this will be <VPC_NETWORK_NAME>

run the following to set instance to a private IP

gcloud beta sql instances patch <INSTANCE_ID> \
--project=<PROJECT_ID> \
--network=projects/<PROJECT_ID>/global/networks/<VPC_NETWORK_NAME> \
--no-assign-ip

Default Value:

Public IP

See Also

https://workbench.cisecurity.org/benchmarks/9562

Item Details

References: CSCv7|9.5

Plugin: GCP

Control ID: d779de07ce5a282d915cc753fa10a4b7fe7c856d0d07bfe3299a223390226198