Google Cloud Compliance ControlsGoogle Cloud SQL
Cloud SQL SQL Server instances should have 'user connections' configured
Cloud SQL for SQL Server instances are evaluated to ensure the `user connections` database flag is set to `0` (unlimited). This avoids any artificial cap on concurrent user sessions.
What this control checks
Whether the user connections database flag is set on Cloud SQL SQL Server instances
Framework mappings
The clauses this control is mapped to in each framework.
- CM-1 Configuration Management Policy and Procedures
- CM-2 Baseline Configuration
- CM-7 Least Functionality
- CM-9 Configuration Management Plan
- Configuration Settings (CM-6)
3 more clauses
- SA-3 System Development Life Cycle
- SA-8 Security Engineering Principles
- SA-10 Developer Configuration Management
- 6.3.3 Ensure 'user Connections' Database Flag for Cloud Sql Sql Server Instance Is Set to a Non-limiting Value
- 6.3.3 Ensure 'user Connections' Database Flag for Cloud SQL SQL Server Instance Is Set to a Non-limiting Value
- COS-03.02B Physical and virtualised network environments are designed and configured to restrict and monitor the established connection to trusted or untrusted networks according to the defined security requirements.
- 6.3.3 Ensure 'user connections' database flag for Cloud SQL SQL Server instance is set as appropriate
- 6.3.3 Ensure 'user connections' database flag for Cloud SQL SQL Server instance is set as appropriate
- 6.3.3 Ensure 'user connections' database flag for Cloud SQL SQL Server instance is set as appropriate
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Related controls
- Cloud SQL SQL Server instances should have 'external scripts enabled' set to 'off'
- Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'
- Cloud SQL PostgreSQL instances should have 'log_connections' set to 'on'
- Cloud SQL instances should have automated backups configured
- Cloud SQL instances should not have public IP addresses
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_sql_user_connections_database_flag_configured - Powerpipe Control:
gcp_compliance.control.sql_instance_sql_user_connections_database_flag_configured - Prowler Check:
cloudsql_instance_sqlserver_user_connections_flag
Last reviewed: 2026-10-10