Cloud SQL SQL Server instances should have 'contained database authentication' set to 'off'
Cloud SQL for SQL Server instances are evaluated for the `contained database authentication` setting. The check inspects the `contained database authentication` flag and expects its value to be `off`.
Enabling contained authentication moves identity checks to the database, bypassing server-level logins and policies. This weakens centralized controls and auditing, enables password spraying on contained users, and can persist users across copies, increasing unauthorized data access and tampering risk to confidentiality and integrity.
What this control checks
Checks the contained database authentication setting on Cloud SQL SQL Server instances
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudsql_instance_sqlserver_contained_database_authentication_flag (prowler gcp --checks cloudsql_instance_sqlserver_contained_database_authentication_flag); PowerPipe control gcp_compliance.control.sql_instance_sql_contained_database_authentication_database_flag_off.
Framework-specific interpretation
SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...) and CC6.3 (The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets...).
PCI DSS v4.0: Mapped to 3.5.1 (Primary account number (PAN) is secured wherever it is stored.), 7.2.1 (Access to system components and data is appropriately defined and assigned.), 7.2.2 (Access to system components and data is appropriately defined and assigned.) and 9 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 11.3.2.a (establish strong identification, authentication such as multi-factor authentication, and authorisation procedures for...), 11.6.1 (The relevant entities shall implement secure authentication procedures and technologies based on access restrictions...), 11.6.2.a (ensure the strength of authentication is appropriate to the classification of the asset to be accessed;) and 1 more clause.
NIST SP 800-53 Rev 5: Mapped to AC-3 (Account Management), AC-5 (Separation Of Duties), AC-6 (Least Privilege) and 1 more clause.
NIST Cybersecurity Framework v2.0: Mapped to ID.RA-09 (The authenticity and integrity of hardware and software are assessed prior to acquisition and use.), PR.AA-02 (Identities are proofed and bound to credentials based on the context of interactions.) and PR.AA-03 (Users, services, and hardware are authenticated.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
7 more clauses
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
- 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session
- 8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components
- 8.3.4: Strong authentication for users and administrators is established and managed.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- 11 Access control
- AC-5 Separation Of Duties
- AC-6: Least Privilege
- Access Enforcement (AC-3)
- Media Access (MP-2)
NIST Cybersecurity Framework v2.0
- ID.RA-09
- PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions.
- PR.AA-03
- 6.3.7 Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is not set to 'on'
- 6.3 Ensure 'contained database authentication' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
- 6.3.7 Ensure 'contained database authentication' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
- PSS-05.01B The cloud service provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility. These authentication mechanisms are set up at all access points that...
- 6.3.7 Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is set to 'off'
- 6.3.7 Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is set to 'off'
- 6.3.7 Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is set to 'off'
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii) Implementation specifications
- 164.312(a)(1) Access control
NIST Cybersecurity Framework v1.0
- PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
Related controls
- Cloud SQL SQL Server instances should have 'external scripts enabled' set to 'off'
- Cloud SQL PostgreSQL instances should have 'log_lock_waits' set to 'on'
- Cloud SQL PostgreSQL instances should have 'log_duration' set to 'on'
- Cloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higher
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_sql_contained_database_authentication_database_flag_off - Powerpipe Control:
gcp_compliance.control.sql_instance_sql_contained_database_authentication_database_flag_off - Prowler Check:
cloudsql_instance_sqlserver_contained_database_authentication_flag
Last reviewed: 2026-10-10