Google Cloud Compliance ControlsGoogle Cloud SQL
Cloud SQL SQL Server instances should have 'remote access' set to 'off'
All `google_sql_database_instance` resources based on SQLSERVER should set the `remote access` flag to `off`. Prowler flags Cloud SQL for SQL Server instances where the `remote access` database flag is `on`, allowing remote procedure calls between servers.
What this control checks
Checks the remote access database flag on Cloud SQL SQL Server instances
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 11 Access control
- CM-7 Least Functionality
- Configuration Settings (CM-6)
- 6.3.5 Ensure 'remote access' database flag for Cloud SQL SQL Server instance is set to 'off'
- 6.3.5 Ensure 'remote access' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 6.3.5 Ensure 'remote access' database flag for Cloud SQL SQL Server instance is set to 'off'
- 6.3.5 Ensure 'remote access' database flag for Cloud SQL SQL Server instance is set to 'off'
- 6.3.5 Ensure 'remote access' database flag for Cloud SQL SQL Server instance is set to 'off'
Related controls
- Cloud SQL SQL Server instances should have 'contained database authentication' set to 'off'
- Cloud SQL SQL Server instances should have 'external scripts enabled' set to 'off'
- Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'
- Cloud SQL instances should not have public IP addresses
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_sql_remote_access_database_flag_off - Powerpipe Control:
gcp_compliance.control.sql_instance_sql_remote_access_database_flag_off - Prowler Check:
cloudsql_instance_sqlserver_remote_access_flag - KICS Query:
d4436ca8-1caf-427c-8911-8b4d31ff6b40
Last reviewed: 2026-10-10