Cloud SQL MySQL instances should have 'local_infile' set to 'off'
Cloud SQL for MySQL instances are evaluated for the `local_infile` database flag being explicitly set to `off`. Instances where `local_infile` is absent or not `off` are identified. The flag disables use of `LOAD DATA LOCAL`.
With local_infile enabled, clients can send local files via LOAD DATA LOCAL. A stolen credential or SQL injection can coerce clients to leak files and mass-ingest unvetted data, compromising confidentiality and integrity, and aiding lateral movement through secrets imported into the database.
What this control checks
Checks Cloud SQL MySQL instances for the local_infile database flag setting
Common pitfalls
Absent local_infile is identified
Instances where local_infile is absent or not off are identified.
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudsql_instance_mysql_local_infile_flag (prowler gcp --checks cloudsql_instance_mysql_local_infile_flag); PowerPipe control gcp_compliance.control.sql_instance_mysql_local_infile_database_flag_off.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Beta - SQL DB Instance With Local Data Loading Enabled" (51a2c34d-dfd0-436f-aa34-e8f796e052fd).
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to CM-6 (Configuration Settings) and CM-7 (Least Functionality).
Framework mappings
The clauses this control is mapped to in each framework.
- CM-7 Least Functionality
- Configuration Settings (CM-6)
- 6.1.3 Ensure That the 'Local_infile' Database Flag for a Cloud SQL MySQL Instance Is Set to 'Off'
- 6.1.3 Ensure That the 'Local_infile' Database Flag for a Cloud SQL MySQL Instance Is Set to 'Off'
- 6.1.3 Ensure that the 'local_infile' database flag for a Cloud SQL Mysql instance is set to 'off'
- 6.1.3 Ensure that the 'local_infile' database flag for a Cloud SQL Mysql instance is set to 'off'
- 6.1.3 Ensure that the 'local_infile' database flag for a Cloud SQL Mysql instance is set to 'off'
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Related controls
- Cloud SQL MySQL instances should have 'skip_show_database' set to 'on'
- Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'
- Cloud SQL PostgreSQL instances should have 'log_lock_waits' set to 'on'
- Cloud SQL PostgreSQL instances should have 'log_temp_files' set to '0'
- Cloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_mysql_local_infile_database_flag_off - Powerpipe Control:
gcp_compliance.control.sql_instance_mysql_local_infile_database_flag_off - Prowler Check:
cloudsql_instance_mysql_local_infile_flag - KICS Query:
51a2c34d-dfd0-436f-aa34-e8f796e052fd
Last reviewed: 2026-10-10