Detections
Analytics

6.9 Ensure Cloud SQL Database Instances Have Deletion Protection Enabled

Information

Ensure that deletion protection is enabled on all Cloud SQL database instances to prevent accidental or unauthorized deletion. This setting safeguards critical databases by requiring explicit disabling of deletion protection before deletion, reducing the risk of data loss through human error or malicious activity.

Cloud SQL instances without deletion protection can be permanently deleted with a single API call or console action, allowing compromised credentials, operational errors, or malicious insiders to cause catastrophic data loss. Deletion protection provides a critical safeguard against inadvertent or malicious deletion of production databases. By requiring deliberate action to disable deletion protection before an instance can be deleted, organizations mitigate risks associated with accidental data deletion and enhance the overall resilience of their data storage platform. This control is particularly important for production workloads where data loss could result in significant business disruption, regulatory compliance violations, and reputational damage.

Solution

From Google Cloud CLI

 - To enable deletion protection on an existing Cloud SQL instance:

gcloud sql instances patch <INSTANCE_NAME> \\
 --deletion-protection

2. To enable deletion protection when creating a new Cloud SQL instance:

gcloud sql instances create <INSTANCE_NAME> \\
 --deletion-protection \\
 --database-version=<DATABASE_VERSION> \\
 --tier=<MACHINE_TYPE> \\
 --region=<REGION>

Impact:

There is no performance impact to enabling deletion protection on Cloud SQL instances. The setting only affects delete operations and does not impact database performance, availability, or operational overhead. Administrators will need to explicitly disable deletion protection before deleting an instance, adding an additional step to the deletion workflow.

See Also

https://workbench.cisecurity.org/benchmarks/22181

Item Details

Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AU-11, 800-53|SI-12

Plugin: GCP

Control ID: 794be4ae6225bf231c9bb589b8c05b2ce9bdf0231fe589438f21d9119a3d28b0