Cloud SQL instances should have IP assignment set to private
Instance addresses can be public IP or private IP. Public IP means that the instance is accessible through the public internet. Instances using only private IP are not accessible through the public internet, but are accessible through a Virtual Private Cloud (VPC).
Public database endpoints expose services to Internet scanning, brute-force logins, and exploit attempts. A compromise can cause data exfiltration (confidentiality), unauthorized changes (integrity), and outages or DDoS impact (availability), while bypassing VPC isolation and enabling lateral movement.
What this control checks
Cloud SQL instances must not be publicly accessible
Common pitfalls
Authorized networks must not be 0.0.0.0/0
If authorized networks are required, restrict to specific sources-never 0.0.0.0/0.
Audit evidence
Evidence that deployed resources meet this control: Prowler checks cloudsql_instance_private_ip_assignment (prowler gcp --checks cloudsql_instance_private_ip_assignment) and cloudsql_instance_public_ip (prowler gcp --checks cloudsql_instance_public_ip); PowerPipe control gcp_compliance.control.sql_instance_not_publicly_accessible.
Scans of the Terraform code that flag the same setting before deployment: Trivy check GCP-0017.
Framework-specific interpretation
SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...) and CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
NIST Cybersecurity Framework v2.0: Mapped to PR.DS-01 (The confidentiality, integrity, and availability of data-at-rest are protected.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 6.2.9 Ensure Instance IP assignment is set to private
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii) Implementation specifications
- 164.312(a)(1) Access control
NIST Cybersecurity Framework v1.0
- PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_not_publicly_accessible - Powerpipe Control:
gcp_compliance.control.sql_instance_not_publicly_accessible - Prowler Checks:
cloudsql_instance_private_ip_assignment,cloudsql_instance_public_ip - Trivy Check:
GCP-0017
Last reviewed: 2026-10-10