Cloud SQL MySQL instances should have 'skip_show_database' set to 'on'
This control checks that Cloud SQL MySQL instances configure the `skip_show_database` database flag to `on`. With the flag on, use of the `SHOW DATABASES` statement is limited to accounts that hold the `SHOW DATABASES` privilege.
Without skip_show_database set to on, database names can be exposed to unprivileged users, reducing confidentiality. Attackers can perform schema enumeration and targeted probing, enabling lateral movement and privilege escalation against specific datasets.
What this control checks
Checks the skip_show_database flag setting on Cloud SQL MySQL instances
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudsql_instance_mysql_skip_show_database_flag (prowler gcp --checks cloudsql_instance_mysql_skip_show_database_flag); PowerPipe control gcp_compliance.control.sql_instance_mysql_skip_show_database_flag_on.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Beta - SQL DB Instance With Exposed Show Privileges" (b5b70198-2a34-4792-b0d9-ce99abe485bb).
Framework-specific interpretation
SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...) and CC6.3 (The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets...).
NIST SP 800-53 Rev 5: Mapped to AC-3 (Account Management), AC-5 (Separation Of Duties), AC-6 (Least Privilege) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- AC-5 Separation Of Duties
- AC-6: Least Privilege
- Access Enforcement (AC-3)
- Media Access (MP-2)
- 6.1.2 Ensure 'Skip_show_database' Database Flag for Cloud SQL MySQL Instance Is Set to 'On'
- 6.1.2 Ensure 'Skip_show_database' Database Flag for Cloud SQL MySQL Instance Is Set to 'On'
- 6.1.2 Ensure 'skip_show_database' database flag for Cloud SQL Mysql instance is set to 'on'
- 6.1.2 Ensure 'skip_show_database' database flag for Cloud SQL Mysql instance is set to 'on'
- 6.1.2 Ensure 'skip_show_database' database flag for Cloud SQL Mysql instance is set to 'on'
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii) Implementation specifications
- 164.312(a)(1) Access control
NIST Cybersecurity Framework v1.0
- PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_mysql_skip_show_database_flag_on - Powerpipe Control:
gcp_compliance.control.sql_instance_mysql_skip_show_database_flag_on - Prowler Check:
cloudsql_instance_mysql_skip_show_database_flag - KICS Query:
b5b70198-2a34-4792-b0d9-ce99abe485bb
Last reviewed: 2026-10-10