Cloud SQL instances should have SSL enabled
Cloud SQL instances enforce SSL/TLS-only connections, rejecting plaintext traffic. The connection policy requires encryption for all clients instead of allowing both encrypted and unencrypted connections.
Without enforced TLS, database traffic is exposed to interception. In-transit data should be encrypted so that if traffic is intercepted data will not be exposed in plaintext to attackers.
What this control checks
Checks the SSL setting on Cloud SQL instances
Common pitfalls
SQL Server supports only ENCRYPTED_ONLY
SQL Server does not support DEFAULT_ALLOWED_SSL_MODES. For SQL Server, ssl_mode must be in SQLSERVER_ALLOWED_SSL_MODES, which is ENCRYPTED_ONLY.
Mixed modes cause plaintext use
Mixed modes cause accidental plaintext use on public or untrusted networks.
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudsql_instance_ssl_connections (prowler gcp --checks cloudsql_instance_ssl_connections); PowerPipe control gcp_compliance.control.require_ssl_sql.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_6; Trivy check GCP-0015.
Framework-specific interpretation
SOC 2: Mapped to CC6.7 (The entity restricts the transmission, movement, and removal of information to authorized internal and external users...).
PCI DSS v4.0: Mapped to 1.2.5 (Network security controls (NSCs) are configured and maintained.), 1.2.8 (Network security controls (NSCs) are configured and maintained.), 2.2.5 (System components are configured and managed securely.) and 3 more clauses.
ISO/IEC 27001:2022: Mapped to A.8.12 (Data Leakage Prevention).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.c (provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.).
NIST Cybersecurity Framework v2.0: Mapped to PR.AA-04 (Identity assertions are protected, conveyed, and verified.) and PR.DS-02 (The confidentiality, integrity, and availability of data-in-transit are protected.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- 1.2.5: Network security controls (NSCs) are configured and maintained.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- 2.2.7: System components are configured and managed securely.
- 4.2.1: PAN is protected with strong cryptography during transmission.
1 more clause
- 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained
- A.8.12 Data leakage prevention
- 12 Asset management
NIST Cybersecurity Framework v2.0
- PR.AA-04
- PR.DS-02
- 6.4 Ensure That the Cloud SQL Database Instance Requires All Incoming Connections To Use SSL
- 6.4 Ensure That the Cloud SQL Database Instance Requires All Incoming Connections To Use SSL
- COS-02.01B Specific security requirements are designed, published and provided for establishing connections within the cloud service provider's network. The security requirements define for the cloud service provider's area of responsibility: - In which cases the security zones are to be...
- COS-03.02B Physical and virtualised network environments are designed and configured to restrict and monitor the established connection to trusted or untrusted networks according to the defined security requirements.
- COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
2 more clauses
- IAM-09.03B Within the production environment, user authentication takes place through passwords, digitally signed certificates or procedures that achieve at least an equivalent level of security. If digitally signed certificates are used, administration is carried out in accordance with the...
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- 6.4 It is recommended to enforce all incoming connections to SQL database instance to use SSL.
- 164.312(e)(1) Transmission security
- 164.312(e)(2)(ii) Encryption
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Related controls
- Cloud SQL instances should not have public IP addresses
- Compute Engine target HTTPS proxies should use the latest TLS version
- Cloud SQL instances should have labels configured
- Cloud SQL PostgreSQL instances should each have 'cloudsql.enable_pgaudit' set to 'on' for centralized logging
- Cloud SQL SQL Server instances should not have 'user options' configured
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
require_ssl_sql - Checkov Check:
CKV_GCP_6 - Powerpipe Control:
gcp_compliance.control.require_ssl_sql - Prowler Check:
cloudsql_instance_ssl_connections - Trivy Check:
GCP-0015
Last reviewed: 2026-10-10