Cloud SQL SQL Server instances should have 'user connections' configured
Cloud SQL for SQL Server instances are evaluated to ensure the `user connections` database flag is set to `0` (unlimited). This avoids any artificial cap on concurrent user sessions.
A capped user connections value can exhaust available sessions, causing login failures, aborted transactions, and timeouts. This reduces availability, can delay administrative access, and may lead to integrity issues from failed or inconsistent retries under load.
What this control checks
Whether the user connections database flag is set on Cloud SQL SQL Server instances
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudsql_instance_sqlserver_user_connections_flag (prowler gcp --checks cloudsql_instance_sqlserver_user_connections_flag).
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to CM-1 (Configuration Management Policy and Procedures), CM-2 (Baseline Configuration), CM-6 (Configuration Settings) and 5 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- CM-1 Configuration Management Policy and Procedures
- CM-2 Baseline Configuration
- CM-7 Least Functionality
- CM-9 Configuration Management Plan
- Configuration Settings (CM-6)
3 more clauses
- SA-3 System Development Life Cycle
- SA-8 Security Engineering Principles
- SA-10 Developer Configuration Management
- 6.3.3 Ensure 'user Connections' Database Flag for Cloud Sql Sql Server Instance Is Set to a Non-limiting Value
- 6.3.3 Ensure 'user Connections' Database Flag for Cloud SQL SQL Server Instance Is Set to a Non-limiting Value
- COS-03.02B Physical and virtualised network environments are designed and configured to restrict and monitor the established connection to trusted or untrusted networks according to the defined security requirements.
- 6.3.3 Ensure 'user connections' database flag for Cloud SQL SQL Server instance is set as appropriate
- 6.3.3 Ensure 'user connections' database flag for Cloud SQL SQL Server instance is set as appropriate
- 6.3.3 Ensure 'user connections' database flag for Cloud SQL SQL Server instance is set as appropriate
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Related controls
- Cloud SQL SQL Server instances should have 'external scripts enabled' set to 'off'
- Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'
- Cloud SQL PostgreSQL instances should have 'log_connections' set to 'on'
- Cloud SQL instances should have automated backups configured
- Cloud SQL instances should not have public IP addresses
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_sql_user_connections_database_flag_configured - Powerpipe Control:
gcp_compliance.control.sql_instance_sql_user_connections_database_flag_configured - Prowler Check:
cloudsql_instance_sqlserver_user_connections_flag
Last reviewed: 2026-10-10