cis_extensions.cloud_sql — version 1.4

Source: presets/cis/cloud-sql.satz

Purpose

CIS 6.5 and 6.6/6.7 — Cloud SQL network exposure.

Opt-in because an estate with existing Cloud SQL instances on public IPs loses connectivity the moment this is enforced; the private path has to exist first. Note the renumbering: public IP is §6.6 in 4.0 and §6.7 in 5.0, while authorized networks stays §6.5 in both.

The constraint name and its shape were verified against a live organisation's OrgPolicy ListConstraints, not transcribed.

Use it

params {
  cis_cloud_sql_hardening = true
}

use "presets/cis/cloud-sql.satz" when cis_cloud_sql_hardening

cis_cloud_sql_hardening is the gate: while it is falsy the pack contributes nothing — no resources, no params, no claims. It is declared by CIS_GCP_Foundation_4_0, and the estate's own binding wins.

Needs from outside the pack:

Params

None — the pack takes everything from the estate's params.

Notices

What to run once this pack is switched on. satz shows each notice when the pack goes on and until the estate binds its param true; every command that writes to the organisation refuses while one whose severity is error is open.

param run severity what and why
cis_cloud_sql_hardening_adopted satz adopt <estate> --execute --import error Google may already hold a policy this pack declares on the organisation, set by an administrator or by default, and an apply that creates a policy that exists stops on 409 POLICY_ALREADY_EXISTS. Run satz adopt once the pack is on, so every live policy is in the state before the apply; with --import it binds this param itself when it has run.

Contributes

resource type labels
google_org_policy_policy sql-managed-restrictAuthorizedNetworks, sql-managed-restrictPublicIp, sql-restrictAuthorizedNetworks (off), sql-restrictPublicIp (off)

Claims

framework control title kind witnesses interpretation
cis-gcp 4.0 6.5 Cloud SQL instances do not whitelist all public IPs implements google_org_policy_policy.sql_managed_restrictAuthorizedNetworks No Cloud SQL instance may carry an authorized network that whitelists every public address.
cis-gcp 5.0 6.5 Cloud SQL instances do not whitelist all public IPs implements google_org_policy_policy.sql_managed_restrictAuthorizedNetworks As for 4.0 §6.5 (5.0 §6.5, unchanged).
cis-gcp 4.0 6.6 Cloud SQL instances do not have public IPs implements google_org_policy_policy.sql_managed_restrictPublicIp Cloud SQL instances may not be given public IP addresses.
cis-gcp 5.0 6.7 Cloud SQL instances do not have public IPs implements google_org_policy_policy.sql_managed_restrictPublicIp As for 4.0 §6.6 — 5.0 §6.7 (5.0 inserted 6.6 IAM database authentication).

What the controls ask (this project's paraphrase from the catalog — never the framework's own text):

Not every resource this pack contributes is a witness:

History

version date change
1.4 2026-09-30 every claim states its measure without satz: gcloud (the commands that meet the control the way the claim's resources do), gcloud_check (the commands that show whether it is met) and risk (what goes wrong without it); require and report-compliance carry them in each control's measures. Nothing emitted changes
1.3 2026-09-20 the notice's before = apply becomes severity = error: the same refusal, stated once by the pack instead of inside the two commands that read it — every command that writes to the organisation refuses while it is open. Nothing emitted changes, and the param that acknowledges it is unchanged
1.2 2026-09-19 a notice: once the pack is switched on, satz adopt <estate> --execute --import is to run before the apply, because a policy it declares may already be live and creating it stops on 409 POLICY_ALREADY_EXISTS. The estate acknowledges it with cis_cloud_sql_hardening_adopted = true, which adopt --execute --import binds itself when it has run; transpile --apply and bootstrap refuse while it is open. The param is never emitted, so the plan does not move
1.1 2026-09-04 declares its two superseded legacy twins (sql.restrictAuthorizedNetworks, sql.restrictPublicIp) off
1.0 2026-09-04 CIS 6.5 and 6.6/6.7 (renumbered in 5.0), opt-in: existing public-IP instances lose connectivity

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

An instance reached over a public IP loses connectivity the moment this is enforced. The private path — the VPC peering or Private Service Connect the clients will use — has to exist and work first.