Detections
Analytics

6.6 Ensure Cloud SQL Database Instances Have IAM Database Authentication Enabled

Information

It is recommended to enable IAM database authentication for Cloud SQL instances (PostgreSQL and MySQL) to eliminate static password-based authentication and instead use short-lived IAM tokens for database access.

IAM database authentication allows applications and users to authenticate to Cloud SQL databases using IAM principals (service accounts, user accounts) instead of traditional database passwords. When enabled, database users can be created that authenticate via IAM, and connections use automatically-generated, short-lived tokens instead of static passwords.

This recommendation is applicable to Cloud SQL for PostgreSQL and Cloud SQL for MySQL instances. Cloud SQL for SQL Server does not support IAM database authentication.

IAM database authentication eliminates static database passwords by using short-lived IAM tokens for database access. This provides automatic credential rotation, centralized access control through Cloud IAM, and immediate revocation capabilities without password distribution across applications. Database access is correlated with GCP IAM principals in Cloud Logging, enabling better audit trails and attribution of database queries to specific service accounts or users. This recommendation is applicable to Cloud SQL for PostgreSQL and MySQL instances.

Solution

From Google Cloud CLI

 - For PostgreSQL instances, use the Google Cloud CLI to enable IAM authentication:

gcloud sql instances patch <INSTANCE_NAME> \\
 --database-flags=cloudsql.iam_authentication=on

Note: This command will overwrite all database flags previously set. To keep existing flags and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign ("=").

For MySQL instances, use the flag cloudsql_iam_authentication=on and follow similar steps.

 - Create Database Users Configured for IAM Authentication**

For Cloud SQL PostgreSQL, create IAM-authenticated users using the Google Cloud CLI:

For user accounts:

gcloud sql users create <user-email> \\
 --instance=<INSTANCE_NAME> \\
 --type=CLOUD_IAM_USER

For service accounts:

gcloud sql users create <service-account-name>@<project-id> \\
 --instance=<INSTANCE_NAME> \\
 --type=CLOUD_IAM_SERVICE_ACCOUNT

Note: Service account usernames should be specified as <service-account-name>@<project-id> without the .iam.gserviceaccount.com suffix.

 - Grant Necessary Privileges to the Database Users

Connect to the database and assign required permissions to the IAM users via standard SQL GRANT commands:

GRANT CONNECT ON DATABASE <dbname> TO "<user-email>";
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO "<user-email>";

For service accounts:

GRANT CONNECT ON DATABASE <dbname> TO "<service-account-name>@<project-id>";
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO "<service-account-name>@<project-id>";

4. Ensure IAM Principals Have Required GCP Permissions

The IAM principal (user or service account) that connects needs the following GCP IAM roles:

For user accounts:

gcloud projects add-iam-policy-binding <PROJECT_ID> \\
 --member=user:<user-email> \\
 --role=roles/cloudsql.client

gcloud projects add-iam-policy-binding <PROJECT_ID> \\
 --member=user:<user-email> \\
 --role=roles/cloudsql.instanceUser

For service accounts:

gcloud projects add-iam-policy-binding <PROJECT_ID> \\
 --member=serviceAccount:<SERVICE_ACCOUNT>@<PROJECT_ID>.iam.gserviceaccount.com \\
 --role=roles/cloudsql.client

gcloud projects add-iam-policy-binding <PROJECT_ID> \\
 --member=serviceAccount:<SERVICE_ACCOUNT>@<PROJECT_ID>.iam.gserviceaccount.com \\
 --role=roles/cloudsql.instanceUser

Where:
- roles/cloudsql.client allows connecting to Cloud SQL instances
- roles/cloudsql.instanceUser allows logging in to Cloud SQL instances with IAM credentials

5. Test the Configuration

Connect to the database using IAM authentication via Cloud SQL Proxy (install Cloud SQL Proxy v1 if not already available):

gcloud beta sql connect <INSTANCE_NAME> \\
 --user=<user-email> \\
 --database=<dbname>

Impact:

Enabling IAM database authentication may require application changes, including updating connection methods and replacing password-based database users with IAM principals. Existing users and scripts that depend on static credentials may need to be reworked, and rollout should be coordinated carefully to avoid service disruption.

See Also

https://workbench.cisecurity.org/benchmarks/22181

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-2(1), 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2

Plugin: GCP

Control ID: b22d4f96c2007773b881e6e5b9c84b677b7a01461aeab788096d4e6c4d1e5b3e