GCP Terraform Misconfiguration: Cloud SQL Database Publicly Accessible

A Terraform configuration enables public access to a Google Cloud SQL Database instance.

Failure to block unwanted network traffic expands a cloud service's attack surface. Services open to interaction with the public are subjected to almost continuous scanning and probing by malicious entities.

By default, Terraform deploys a Google Cloud SQL Database instance that only accepts connections from private IP addresses. Optional Authorized Networks settings define acceptable ranges of public IP addresses.

Example 1: The following Terraform configuration sets value to 0.0.0.0/0 in the authorized_networks block. A CIDR block of /0 accepts connections from any IP address between 0.0.0.0 and 255.255.255.255.

resource "google_sql_database_instance" "db-demo" {
  ...
  settings {
  ...
    ip_configuration {
    ...
      authorized_networks {
        name  = "any ip"
        value = "0.0.0.0/0"
      }
    ...
    }
    ...
  }
  ...
}