Google Cloud Compliance ControlsGoogle Cloud SQL
Cloud SQL SQL Server instances should have 'contained database authentication' set to 'off'
Cloud SQL for SQL Server instances are evaluated for the `contained database authentication` setting. The check inspects the `contained database authentication` flag and expects its value to be `off`.
What this control checks
Checks the contained database authentication setting on Cloud SQL SQL Server instances
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
7 more clauses
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
- 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session
- 8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components
- 8.3.4: Strong authentication for users and administrators is established and managed.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- 11 Access control
- AC-5 Separation Of Duties
- AC-6: Least Privilege
- Access Enforcement (AC-3)
- Media Access (MP-2)
NIST Cybersecurity Framework v2.0
- ID.RA-09
- PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions.
- PR.AA-03
- 6.3.7 Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is not set to 'on'
- 6.3 Ensure 'contained database authentication' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
- 6.3.7 Ensure 'contained database authentication' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
- PSS-05.01B The cloud service provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility. These authentication mechanisms are set up at all access points that...
- 6.3.7 Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is set to 'off'
- 6.3.7 Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is set to 'off'
- 6.3.7 Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is set to 'off'
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii) Implementation specifications
- 164.312(a)(1) Access control
NIST Cybersecurity Framework v1.0
- PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
Related controls
- Cloud SQL SQL Server instances should have 'external scripts enabled' set to 'off'
- Cloud SQL PostgreSQL instances should have 'log_lock_waits' set to 'on'
- Cloud SQL PostgreSQL instances should have 'log_duration' set to 'on'
- Cloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higher
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_sql_contained_database_authentication_database_flag_off - Powerpipe Control:
gcp_compliance.control.sql_instance_sql_contained_database_authentication_database_flag_off - Prowler Check:
cloudsql_instance_sqlserver_contained_database_authentication_flag
Last reviewed: 2026-10-10