Google Cloud Compliance ControlsGoogle Cloud SQL
Cloud SQL instances should prohibit world-readable access
Checks that Cloud SQL database instances are not open to the world. Prowler flags a catch-all `0.0.0.0/0` entry in authorized networks on instances using a public IP. Trivy says instances should not be available over the public internet.
What this control checks
Cloud SQL authorized networks must not contain 0.0.0.0/0; instances must not be publicly exposed.
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 1.4.5 The disclosure of internal IP addresses and routing information is limited to only authorized parties
11 more clauses
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
- 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- AC-5 Separation Of Duties
- AC-6: Least Privilege
- Access Enforcement (AC-3)
- Media Access (MP-2)
- 6.5 Ensure That Cloud SQL Database Instances Do Not Implicitly Whitelist All Public IP Addresses
- 6.6 Ensure That Cloud SQL Database Instances Do Not Have Public IPs
- 6.5 Ensure That Cloud SQL Database Instances Do Not Implicitly Whitelist All Public IP Addresses
- 6.6 Ensure That Cloud SQL Database Instances Do Not Have Public IPs
- COS-02.01B Specific security requirements are designed, published and provided for establishing connections within the cloud service provider's network. The security requirements define for the cloud service provider's area of responsibility: - In which cases the security zones are to be...
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service...
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
2 more clauses
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 6.5 Database Server should accept connections only from trusted Network(s)/IP(s) and restrict access from public IP addresses.
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(4)(i) Information access management
- 164.312(a)(1) Access control
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_world_readable - Checkov Check:
CKV_GCP_11 - Powerpipe Control:
gcp_compliance.control.sql_world_readable - Prowler Check:
cloudsql_instance_public_access - Trivy Check:
GCP-0017
Last reviewed: 2026-10-10