Description
SQL Server’s contained database authentication allows users to authenticate within a database independently of server logins. When enabled, database user-management permissions become part of access control.
Potential impact
Broad permissions to create database users can allow access to be granted outside server-level login management.
Remediation
If this authentication method is unnecessary, set contained database authentication to off in settings.database_flags. Check existing contained database users and application dependencies before changing it. Where required, restrict user-creation permissions.
Examples
These excerpts show the flag disabled for an instance that does not need the feature. Other required instance settings are omitted.
Before
hcl
resource "google_sql_database_instance" "sqlserver_instance" {
name = "sqlserver-instance"
database_version = "SQLSERVER_2017_EXPRESS"
region = "us-central1"
settings {
database_flags {
name = "contained database authentication"
value = "on"
}
}
}
After
hcl
resource "google_sql_database_instance" "sqlserver_instance" {
name = "sqlserver-instance"
database_version = "SQLSERVER_2019_STANDARD"
region = "us-central1"
settings {
database_flags {
name = "contained database authentication"
value = "off"
}
}
}