Google Cloud Compliance ControlsGoogle Cloud SQL
Cloud SQL instances should have IP assignment set to private
Instance addresses can be public IP or private IP. Public IP means that the instance is accessible through the public internet. Instances using only private IP are not accessible through the public internet, but are accessible through a Virtual Private Cloud (VPC).
What this control checks
Cloud SQL instances must not be publicly accessible
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 6.2.9 Ensure Instance IP assignment is set to private
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii) Implementation specifications
- 164.312(a)(1) Access control
NIST Cybersecurity Framework v1.0
- PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_not_publicly_accessible - Powerpipe Control:
gcp_compliance.control.sql_instance_not_publicly_accessible - Prowler Checks:
cloudsql_instance_private_ip_assignment,cloudsql_instance_public_ip - Trivy Check:
GCP-0017
Last reviewed: 2026-10-10