Google Cloud Compliance ControlsGoogle Cloud SQL
Cloud SQL MySQL instances should have 'local_infile' set to 'off'
Cloud SQL for MySQL instances are evaluated for the `local_infile` database flag being explicitly set to `off`. Instances where `local_infile` is absent or not `off` are identified. The flag disables use of `LOAD DATA LOCAL`.
What this control checks
Checks Cloud SQL MySQL instances for the local_infile database flag setting
Framework mappings
The clauses this control is mapped to in each framework.
- CM-7 Least Functionality
- Configuration Settings (CM-6)
- 6.1.3 Ensure That the 'Local_infile' Database Flag for a Cloud SQL MySQL Instance Is Set to 'Off'
- 6.1.3 Ensure That the 'Local_infile' Database Flag for a Cloud SQL MySQL Instance Is Set to 'Off'
- 6.1.3 Ensure that the 'local_infile' database flag for a Cloud SQL Mysql instance is set to 'off'
- 6.1.3 Ensure that the 'local_infile' database flag for a Cloud SQL Mysql instance is set to 'off'
- 6.1.3 Ensure that the 'local_infile' database flag for a Cloud SQL Mysql instance is set to 'off'
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Related controls
- Cloud SQL MySQL instances should have 'skip_show_database' set to 'on'
- Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'
- Cloud SQL PostgreSQL instances should have 'log_lock_waits' set to 'on'
- Cloud SQL PostgreSQL instances should have 'log_temp_files' set to '0'
- Cloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_mysql_local_infile_database_flag_off - Powerpipe Control:
gcp_compliance.control.sql_instance_mysql_local_infile_database_flag_off - Prowler Check:
cloudsql_instance_mysql_local_infile_flag - KICS Query:
51a2c34d-dfd0-436f-aa34-e8f796e052fd
Last reviewed: 2026-10-10