Google Cloud Compliance ControlsGoogle Cloud SQL
Cloud SQL SQL Server instances should not have 'user options' configured
Cloud SQL for SQL Server instances are evaluated for the 'user options' database flag. No `google_sql_database_instance` resource based on SQLSERVER should define the 'user options' flag. The check identifies instances where this global override is present.
What this control checks
SQL Server instances must not define the 'user options' database flag.
Framework mappings
The clauses this control is mapped to in each framework.
- CM-1 Configuration Management Policy and Procedures
- CM-2 Baseline Configuration
- CM-7 Least Functionality
- CM-9 Configuration Management Plan
- Configuration Settings (CM-6)
3 more clauses
- SA-3 System Development Life Cycle
- SA-8 Security Engineering Principles
- SA-10 Developer Configuration Management
- 6.3.4 Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured
- 6.3.4 Ensure 'user options' Database Flag for Cloud SQL SQL Server Instance Is Not Configured
- 6.3.4 Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured
- 6.3.4 Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured
- 6.3.4 Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_sql_user_options_database_flag_not_configured - Powerpipe Control:
gcp_compliance.control.sql_instance_sql_user_options_database_flag_not_configured - Prowler Check:
cloudsql_instance_sqlserver_user_options_flag - KICS Query:
c8e4444e-d9a9-4426-be8e-9f1b8c43133c
Last reviewed: 2026-10-10