Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'
Cloud SQL SQL Server instances are evaluated for the `cross db ownership chaining` server flag. The finding identifies SQL Server instances where this flag isn't set to `off`, meaning cross-database ownership chaining is permitted.
Allowing cross-database ownership chaining erodes database boundaries, impacting confidentiality and integrity. Users with privileges in one database can traverse ownership chains to access or modify objects in others, enabling privilege escalation, lateral movement, and unauthorized data exposure.
What this control checks
Cloud SQL SQL Server cross db ownership chaining flag must be set to off.
Common pitfalls
Flag is deprecated, do not enable it
This flag is deprecated-do not enable it.
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag (prowler gcp --checks cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag); PowerPipe control gcp_compliance.control.sql_instance_sql_cross_db_ownership_chaining_database_flag_off.
Framework-specific interpretation
SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...) and CC6.3 (The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets...).
NIST SP 800-53 Rev 5: Mapped to AC-3 (Account Management), AC-5 (Separation Of Duties), AC-6 (Least Privilege) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- AC-5 Separation Of Duties
- AC-6: Least Privilege
- Access Enforcement (AC-3)
- Media Access (MP-2)
- 6.3.2 Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'
- 6.3.2 Ensure 'cross db ownership chaining' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
- 6.3.2 Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'
- 6.3.2 Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'
- 6.3.2 Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii) Implementation specifications
- 164.312(a)(1) Access control
NIST Cybersecurity Framework v1.0
- PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
Related controls
- Cloud SQL MySQL instances should have 'local_infile' set to 'off'
- Cloud SQL MySQL instances should have 'skip_show_database' set to 'on'
- Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'
- Cloud SQL PostgreSQL instances should have 'log_lock_waits' set to 'on'
- Cloud SQL instances should have automated backups configured
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_sql_cross_db_ownership_chaining_database_flag_off - Powerpipe Control:
gcp_compliance.control.sql_instance_sql_cross_db_ownership_chaining_database_flag_off - Prowler Check:
cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag
Last reviewed: 2026-10-10