Review external script execution in GCP Cloud SQL

Disable unused SQL Server external script execution

Description

SQL Server’s external scripts enabled setting enables script execution through supported external language extensions. Execution also requires the relevant components and permissions. Disable the feature when it is unused.

Potential impact

Misused external script permissions may provide a path to execute additional code or access data through the database.

Remediation

If the feature is unnecessary, set external scripts enabled to off in settings.database_flags. Check for dependent jobs and plan the restart required to apply the Cloud SQL change.

Examples

These excerpts disable the flag for an instance that does not use external scripts. Other required instance settings are omitted.

Before

hcl
resource "google_sql_database_instance" "sqlserver_instance" {
  name             = "sqlserver-instance"
  database_version = "SQLSERVER_2017_EXPRESS"
  region           = "us-central1"

  settings {
    database_flags {
      name  = "external scripts enabled"
      value = "on"
    }
  }
}

After

hcl
resource "google_sql_database_instance" "sqlserver_instance" {
  name             = "sqlserver-instance"
  database_version = "SQLSERVER_2019_STANDARD"
  region           = "us-central1"

  settings {
    database_flags {
      name  = "external scripts enabled"
      value = "off"
    }
  }
}

References