Cloud SQL SQL Server instances should not have 'user options' configured
Cloud SQL for SQL Server instances are evaluated for the 'user options' database flag. No `google_sql_database_instance` resource based on SQLSERVER should define the 'user options' flag. The check identifies instances where this global override is present.
Global user options changes affect all sessions, impacting data integrity and availability. Disabling safe ANSI behaviors or enabling implicit transactions can alter NULL comparisons and error handling, leading to inconsistent results, lock contention, and application failures, reducing predictability and complicating auditing.
What this control checks
SQL Server instances must not define the 'user options' database flag.
Common pitfalls
Flag fails the check with any value
Cloud SQL for SQL Server instances are evaluated for the user options database flag configured with any value.
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudsql_instance_sqlserver_user_options_flag (prowler gcp --checks cloudsql_instance_sqlserver_user_options_flag); PowerPipe control gcp_compliance.control.sql_instance_sql_user_options_database_flag_not_configured.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Beta - SQL DB Instance With Global User Options" (c8e4444e-d9a9-4426-be8e-9f1b8c43133c).
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to CM-1 (Configuration Management Policy and Procedures), CM-2 (Baseline Configuration), CM-6 (Configuration Settings) and 5 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- CM-1 Configuration Management Policy and Procedures
- CM-2 Baseline Configuration
- CM-7 Least Functionality
- CM-9 Configuration Management Plan
- Configuration Settings (CM-6)
3 more clauses
- SA-3 System Development Life Cycle
- SA-8 Security Engineering Principles
- SA-10 Developer Configuration Management
- 6.3.4 Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured
- 6.3.4 Ensure 'user options' Database Flag for Cloud SQL SQL Server Instance Is Not Configured
- 6.3.4 Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured
- 6.3.4 Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured
- 6.3.4 Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_sql_user_options_database_flag_not_configured - Powerpipe Control:
gcp_compliance.control.sql_instance_sql_user_options_database_flag_not_configured - Prowler Check:
cloudsql_instance_sqlserver_user_options_flag - KICS Query:
c8e4444e-d9a9-4426-be8e-9f1b8c43133c
Last reviewed: 2026-10-10