Ensure That the Cloud SQL Database Instance Requires All Incoming Connections To Use SSL

Description:

It is recommended to enforce all incoming connections to SQL database instance to use SSL.

Rationale:

SQL database connections if successfully trapped (MITM); can reveal sensitive data like credentials, database queries, query outputs etc.
For security, it is recommended to always use SSL encryption when connecting to your instance.
This recommendation is applicable for Postgresql, MySql generation 1, MySql generation 2 and SQL Server 2017 instances.

After enforcing SSL connection, existing client will not be able to communicate with SQL server unless configured with appropriate client-certificates to communicate to SQL database instance.

From Google Cloud Console

1. Go to https://console.cloud.google.com/sql/instances.

2. Click on an instance name to see its configuration overview.

3. In the left-side panel, select 'Connections'.

4. In the 'SSL connections' section, click 'Allow only SSL connections'.

5. Under 'Configure SSL server certificates' click 'Create new certificate'.

6. Under 'Configure SSL client certificates' click 'Create a client certificate'.

7. Follow the instructions shown to learn how to connect to your instance.

From Google Cloud CLI

To enforce SSL encryption for an instance run the command:

gcloud sql instances patch --require-ssl

Note:
'RESTART' is required for type MySQL Generation 1 Instances ('backendType: FIRST_GEN') to get this configuration in effect.