Detections
Analytics

6.4 Ensure That the Cloud SQL Database Instance Requires All Incoming Connections To Use SSL

Information

It is recommended to enforce all incoming connections to SQL database instance to use SSL.

SQL database connections if successfully trapped (MITM); can reveal sensitive data like credentials, database queries, query outputs etc.
For security, it is recommended to always use SSL encryption when connecting to your instance.
This recommendation is applicable for Postgresql, MySql generation 1, MySql generation 2 and SQL Server 2017 instances.

Solution

From Google Cloud Console

Mode: ENCRYPTED_ONLY

 -

Go to https://console.cloud.google.com/sql/instances.

 -

Click on an instance name to see its configuration overview.

 -

In the left-side panel, select Connections.

 -

In the security section, select SSL mode as Allow only SSL connections.

 -

Under Configure SSL server certificates click Create new certificate and save the setting

From Google Cloud Console

Mode : TRUSTED_CLIENT_CERTIFICATE_REQUIRED

1.Go to https://console.cloud.google.com/sql/instances.

2.Click the instance name to open its overview

3.Click Connections in the left navigation menu

4.Select the Security tab

5.Under SSL mode, select Require trusted client certificates

6.Under Configure SSL server certificates, click Create new certificate

7.Under Configure SSL client certificates, click Create a client certificate for each connecting client

8.Follow the instructions shown to deploy certs to connecting clients, then click Save

From Google Cloud CLI

Mode: ENCRYPTED_ONLY

1.To enforce SSL encryption for an instance run the commands:

gcloud sql instances patch INSTANCE_NAME --ssl-mode= ENCRYPTED_ONLY

2.Verify the made changes:

gcloud sql instances list --format=json

From Google Cloud CLI

Mode: TRUSTED_CLIENT_CERTIFICATE_REQUIRED

1.Enforce mode:

gcloud sql instances patch INSTANCE_NAME \\
 --ssl-mode=TRUSTED_CLIENT_CERTIFICATE_REQUIRED

2.Create client certificate

gcloud sql ssl client-certs create CERT_NAME \\
 client-key.pem \\
 --instance=INSTANCE_NAME

3.Download client public cert

gcloud sql ssl client-certs describe CERT_NAME \\
 --instance=INSTANCE_NAME \\
 --format="value(cert)" > client-cert.pem

4.Download server CA cert:

gcloud sql ssl server-ca-certs list \\
 --format="value(cert)" \\
 --instance=INSTANCE_NAME > server-ca.pem

5.Verify mode using the commands;

gcloud sql instances list --format=json

6.Expected in settings.ipConfiguration :

"sslMode": "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"

7.To roll back to the previous certificate configuration, use the commands:

gcloud sql ssl server-ca-certs rollback \\
--instance=INSTANCE_NAME

Note:
RESTART is required for type MySQL Generation 1 Instances ( backendType: FIRST_GEN ) to get this configuration in effect.

Impact:

After enforcing SSL requirement for connections, existing client will not be able to communicate with Cloud SQL database instance unless they use SSL encrypted connections to communicate to Cloud SQL database instance.

See Also

https://workbench.cisecurity.org/benchmarks/22181

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4, CSCv7|16.5

Plugin: GCP

Control ID: bc365b04abd10d33653a9b42b38a27e425b9595f817ed50c3091924c3d63c456