Ensure 'external scripts enabled' database flag for Cloud SQL SQL Server instance is set to 'off'

Risk Level: Medium
Cloud Entity: GCP CloudSql
CloudGuard Rule ID: D9.GCP.VLN.06
Covered by Spectral: Yes
Category: Database

GSL LOGIC

CloudSql where databaseVersion like 'SQLSERVER%' should have settings.databaseFlags contain [ name like 'external scripts enabled' and value like 'off' ]

REMEDIATION

From Portal

1. Navigate to the instance where the flag needs to be set: https://console.cloud.google.com/sql/instances
2. Click Edit Configurations
3. Under flags section, choose add flag, look for 'external scripts enabled' and choose value - off.
4. Save and review your changes

From TF
Set the flag 'external scripts enabled' to 'off':

resource 'google_sql_database_instance' 'default' {
	...
	settings {
		database_flags {
			name  = 'external scripts enabled'
			value = 'off'
		}
	}
}

From Command Line

1. First retrieve all existing flags values:

gcloud sql instances describe INSTANCE_NAME

2. Add all existing flags and their value to the patch request - otherwise they will get set to their default value.

gcloud sql instances patch INSTANCE_NAME --database-flags (ExistingFlag1=Value1,ExistingFlag2=Value2,...),'external scripts enabled'=off

References

1. https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/external-scripts-enabled-server-configuration-option?view=sql-server-ver15
2. https://cloud.google.com/sql/docs/sqlserver/flags
3. https://docs.microsoft.com/en-us/sql/advanced-analytics/concepts/security?view=sql-server-ver15
4. https://www.stigviewer.com/stig/ms_sql_server_2016_instance/2018-03-09/finding/V-79347

GCP CloudSql

Cloud SQL is a fully managed database service that makes it easy to set up, maintain, manage, and administer your relational PostgreSQL, MySQL, and SQL Server databases in the cloud.

Compliance Frameworks

• CloudGuard GCP All Rules Ruleset
• GCP CIS Controls V 8
• GCP CIS Foundations v. 1.2.0
• GCP CIS Foundations v. 1.3.0
• GCP CIS Foundations v. 2.0
• GCP CloudGuard Best Practices
• GCP MITRE ATT&CK Framework v12.1
• GCP NIST 800-53 Rev 5