📝 Google Cloud SQL Server Instance user options Database Flag is configured 🟢

• Contextual name: 📝 SQL Server Instance user options Database Flag is configured 🟢
• ID: /ce/ca/google/sql/sqlserver-instance-user-options-flag
• Located in: 📁 Google Cloud SQL

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Disable 'user options' Flag for SQL Server Instances

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Google Cloud SQL Instance
  • 🔌 Google Cloud SQL Instance - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

It is recommended that, user options database flag for Cloud SQL SQL Server instance should not be configured.

Rationale

The user options option specifies global defaults for all users. A list of default query processing options is established for the duration of a user's work session. The user options option allows you to change the default values of the SET options (if the server's default settings are not appropriate).

A user can override these defaults by using the SET statement. You can configure user options dynamically for new logins. After you change the setting of user options, new login sessions use the new setting; current login sessions are not affected. This recommendation is applicable to SQL Server database instances.

Impact

Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.

... see more

Remediation

Open File

Remediation

From Google Cloud Console

1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting https://console.cloud.google.com/sql/instances.
2. Select the SQL Server instance for which you want to enable to database flag.
3. Click Edit.
4. Scroll down to the Flags section.
5. Click the X next user options flag shown
6. Click Save to save your changes.
7. Confirm your changes under Flags on the Overview page.

From Google Cloud CLI

1. List all Cloud SQL database Instances

        gcloud sql instances list

2. Clear the user options database flag for every Cloud SQL SQL Server database instance using either of the below commands.

Clearing all flags to their default value

        gcloud sql instances patch <INSTANCE_NAME> --clear-database-flags

OR

To clear only user options database flag, configure the database flag by overriding the user options. Exclude user options flag and its value, and keep all other flags you want to configure.

        gcloud sql instances patch <INSTANCE_NAME> --database-flags [FLAG1=VALUE1,FLAG2=VALUE2]

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS GCP v3.0.0 → 💼 6.3.4 Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured - Level 1 (Automated)			1
💼 Cloudaware Framework → 💼 Secure Access			43