Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'
Checks that Cloud SQL for SQL Server instances have the `3625` trace flag database flag set to `on`. Without it enabled, SQL Server error messages can reveal parameters and object names to users who are not administrators.
Without 3625 enabled, SQL errors can reveal parameters and object names to non-admins, weakening confidentiality and aiding targeted injection, account enumeration, and data discovery. Leaked context helps craft exploits and pivot attacks, ultimately risking data integrity and availability.
What this control checks
Checks the 3625 database flag on Cloud SQL SQL Server instances
Common pitfalls
Flag set to off still fails
All 'google_sql_database_instance' resources based on SQLSERVER should enable the '3625'(trace log) flag to prevent the disclosure of sensitive information.
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudsql_instance_sqlserver_trace_flag (prowler gcp --checks cloudsql_instance_sqlserver_trace_flag).
Scans of the Terraform code that flag the same setting before deployment: KICS query "Beta - SQL DB Instance With Exposed Trace Logs" (f5aff735-fd1c-4751-a5e9-98bfe4893fa2).
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to CM-1 (Configuration Management Policy and Procedures), CM-2 (Baseline Configuration), CM-6 (Configuration Settings) and 5 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- CM-1 Configuration Management Policy and Procedures
- CM-2 Baseline Configuration
- CM-7 Least Functionality
- CM-9 Configuration Management Plan
- Configuration Settings (CM-6)
3 more clauses
- SA-3 System Development Life Cycle
- SA-8 Security Engineering Principles
- SA-10 Developer Configuration Management
- 6.3.6 Ensure '3625 (trace flag)' database flag for all Cloud SQL Server instances is set to 'on'
- 6.3 Ensure 'contained database authentication' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
- 6.3.6 Ensure '3625 (trace flag)' Database Flag for all Cloud SQL SQL Server Instances Is Set to 'on'
- 6.3.6 Ensure '3625 (trace flag)' database flag for Cloud SQL SQL Server instance is set to 'off'
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_sql_3625_trace_database_flag_on - Powerpipe Control:
gcp_compliance.control.sql_instance_sql_3625_trace_database_flag_on - Prowler Check:
cloudsql_instance_sqlserver_trace_flag - KICS Query:
f5aff735-fd1c-4751-a5e9-98bfe4893fa2
Last reviewed: 2026-10-10