Google Cloud Compliance ControlsGoogle Cloud SQL
Cloud SQL instances should not have public IP addresses
Cloud SQL instances are evaluated for IP assignment. Instances that have any public IP instead of private IP only are highlighted. Public IP means that the instance is accessible through the public internet.
What this control checks
Cloud SQL instances should not have public IP addresses
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
3 more clauses
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- 12 Asset management
- AC-5 Separation Of Duties
- AC-6: Least Privilege
- Access Enforcement (AC-3)
- MA-4: Nonlocal Maintenance
- Media Access (MP-2)
- COS-02.01B Specific security requirements are designed, published and provided for establishing connections within the cloud service provider's network. The security requirements define for the cloud service provider's area of responsibility: - In which cases the security zones are to be...
- 6.2.9 Ensure Instance IP assignment is set to private
- 6.6 It is recommended to configure Second Generation Sql instance to use private IPs instead of public IPs.
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii) Implementation specifications
- 164.312(a)(1) Access control
NIST Cybersecurity Framework v1.0
- PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
prevent_public_ip_cloudsql - Powerpipe Controls:
gcp_compliance.control.prevent_public_ip_cloudsql,gcp_compliance.control.sql_instance_not_publicly_accessible - Prowler Checks:
cloudsql_instance_private_ip_assignment,cloudsql_instance_public_ip - Trivy Check:
GCP-0017
Last reviewed: 2026-10-09