Cross DB Ownership Chaining Should Be Disabled

More Info:

Ensure that the cross db ownership chaining database flag for Cloud SQL SQL Server instance is set to off.

Risk Level

Medium

Address

Security

Compliance Standards

CIS GCP
CIS GCP 2.0.0
Cloudanix Best Practice

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the "Cross DB Ownership Chaining Should Be Disabled" misconfiguration in GCP, you can follow the below steps:

Open the Google Cloud Console and navigate to the Cloud SQL instances page.
Select the instance for which you want to disable cross-database ownership chaining.
Click on the "Edit" button to modify the instance configuration.
In the "Flags" section, click on the "Add item" button to add a new flag.
Enter the flag name as "cross_db_ownership_chaining" and set its value to "off".
Click on the "Save" button to save the changes.
Restart the instance for the changes to take effect.

Once the instance is restarted, cross-database ownership chaining will be disabled.

Using CLI

To remediate the "Cross DB Ownership Chaining Should Be Disabled" misconfiguration in GCP using GCP CLI, you can follow these steps:

Open the Cloud Shell in the GCP console.
Run the following command to authenticate yourself and set the project to the one you want to work on:

gcloud auth login
gcloud config set project [PROJECT_ID]

Replace [PROJECT_ID] with the ID of your GCP project.

Run the following command to list all the Cloud SQL instances in your project:

gcloud sql instances list

Choose the instance that you want to remediate and run the following command to update its configuration:

gcloud sql instances patch [INSTANCE_NAME] --database-flags=disable_cross_db_owner_chaining=on

Replace [INSTANCE_NAME] with the name of your Cloud SQL instance.

Verify that the configuration has been updated by running the following command:

gcloud sql instances describe [INSTANCE_NAME]

This command should return a JSON object that includes the updated configuration.

By following these steps, you have successfully remediated the "Cross DB Ownership Chaining Should Be Disabled" misconfiguration in GCP using GCP CLI.

Using Python

To remediate the "Cross DB Ownership Chaining Should Be Disabled" misconfiguration in GCP using Python, you can follow the below steps:

Connect to the GCP project using the Python SDK.
Get a list of all the Cloud SQL instances in the project using the list() method of the google.cloud.sql_v1beta4.CloudSqlInstancesServiceClient class.
For each Cloud SQL instance, check if the cross_db_ownership_chaining flag is set to ON or OFF by using the get() method of the google.cloud.sql_v1beta4.CloudSqlInstancesServiceClient class.
If the cross_db_ownership_chaining flag is set to ON, update the instance's configuration by creating an instance update request using the google.cloud.sql_v1beta4.types.SqlInstancesUpdateRequest class and setting the cross_db_ownership_chaining flag to OFF.
Execute the instance update request using the patch() method of the google.cloud.sql_v1beta4.CloudSqlInstancesServiceClient class.
Repeat steps 3-5 for all the Cloud SQL instances in the project.

Here's a sample Python code that you can use to remediate the "Cross DB Ownership Chaining Should Be Disabled" misconfiguration in GCP:

from google.cloud import sql_v1beta4
from google.cloud.sql_v1beta4.types import SqlInstancesUpdateRequest

# Set the GCP project ID and region
project_id = 'your-project-id'
region = 'your-region'

# Connect to the GCP project using the Python SDK
client = sql_v1beta4.CloudSqlInstancesServiceClient()

# Get a list of all the Cloud SQL instances in the project
instances = client.list(project=project_id, region=region)

# For each Cloud SQL instance, check if the cross_db_ownership_chaining flag is set to ON or OFF
for instance in instances:
    instance_name = instance.name
    instance_settings = client.get(instance=instance_name)

    # If the cross_db_ownership_chaining flag is set to ON, update the instance's configuration
    if instance_settings.settings.database_flags.get('cross_db_ownership_chaining') == 'ON':
        instance_settings.settings.database_flags['cross_db_ownership_chaining'] = 'OFF'
        update_request = SqlInstancesUpdateRequest(instance=instance_name, settings=instance_settings.settings)
        operation = client.patch(update_request)

        # Wait for the operation to complete
        operation.result()

Note: You need to have the necessary permissions to access and modify Cloud SQL instances in the GCP project.

Using Terraform

resource "google_sql_database_instance" "SQL_SERVER_INSTANCE" {
  name             = "YOUR_INSTANCE_NAME"      # replace with your instance name
  database_version = "SQLSERVER_2019_STANDARD" # replace with your SQL Server edition/version
  region           = "YOUR_REGION"             # replace with your region, e.g. "us-central1"

  settings {
    tier = "YOUR_MACHINE_TIER"                 # e.g. "db-custom-2-7680"

    # Add to your existing database_flags block(s) if present
    database_flags {
      name  = "cross db ownership chaining"
      value = "off"
    }
  }
}

This change does not force replacement of the instance, but may require a restart of the Cloud SQL instance for the flag to take effect.

On terraform plan, you should see an update to the settings.0.database_flags list adding (or changing) the flag cross db ownership chaining with value off for the google_sql_database_instance.SQL_SERVER_INSTANCE resource.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​