Description
SQL Server’s external scripts enabled setting enables script execution through supported external language extensions. Execution also requires the relevant components and permissions. Disable the feature when it is unused.
Potential impact
Misused external script permissions may provide a path to execute additional code or access data through the database.
Remediation
If the feature is unnecessary, set external scripts enabled to off in settings.database_flags. Check for dependent jobs and plan the restart required to apply the Cloud SQL change.
Examples
These excerpts disable the flag for an instance that does not use external scripts. Other required instance settings are omitted.
Before
hcl
resource "google_sql_database_instance" "sqlserver_instance" {
name = "sqlserver-instance"
database_version = "SQLSERVER_2017_EXPRESS"
region = "us-central1"
settings {
database_flags {
name = "external scripts enabled"
value = "on"
}
}
}
After
hcl
resource "google_sql_database_instance" "sqlserver_instance" {
name = "sqlserver-instance"
database_version = "SQLSERVER_2019_STANDARD"
region = "us-central1"
settings {
database_flags {
name = "external scripts enabled"
value = "off"
}
}
}