1. Log in to the GCP Console (https://console.cloud.google.com/).
2. Navigate to the GCP project that has the misconfigured MySQL port.
3. In the navigation menu, click on “Compute Engine”.
4. Select the VM instance that has the open MySQL port.
5. Click on the “Edit” button at the top of the page.
6. Scroll down to the “Firewall” section and click on “Networking”.
7. Under the “Firewall rules” section, click on “default-allow-mysql”.
8. Click on the “Delete” button to remove the rule.
9. Click on the “Save” button at the bottom of the page to apply the changes.

​

1. Open the GCP Console and go to the Cloud Shell.
2. Run the following command to list all the instances in your project:

3. Identify the instance that has the open MySQL port.
4. Run the following command to SSH into the instance:

5. Once you are logged in to the instance, run the following command to edit the mysqld.cnf file:

6. Look for the following line in the file:

7. Comment out this line by adding a # at the beginning of the line:

8. Save the changes and exit the file.
9. Restart the MySQL service by running the following command:

10. Exit the SSH session by running the following command:

1. Import the necessary libraries:

from google.cloud import compute_v1
import google.auth

2. Authenticate and create a client object:

creds, project = google.auth.default()
compute_client = compute_v1.ComputeClient(credentials=creds)

3. Define the project and zone where the instance is located:

project = 'your-project-id'
zone = 'us-central1-a'

4. Define the instance name and the network tag associated with the instance:

instance_name = 'your-instance-name'
network_tag = 'your-network-tag'

5. Get the instance details using the get method:

instance = compute_client.instances().get(project=project, zone=zone, instance=instance_name).execute()

6. Check if the MySQL port is open by looking at the instance’s network tags:

if network_tag in instance['tags']['items']:
    if '3306' in instance['metadata']['items'][0]['value']:
        print('MySQL port is open')

7. If the MySQL port is open, remove it from the instance’s metadata:

metadata = instance['metadata']
items = metadata['items']
new_items = []
for item in items:
    if item['key'] == 'gce-container-declaration':
        container = json.loads(item['value'])
        ports = container['ports']
        new_ports = []
        for port in ports:
            if port['containerPort'] != 3306:
                new_ports.append(port)
        container['ports'] = new_ports
        item['value'] = json.dumps(container)
    new_items.append(item)
metadata['items'] = new_items
compute_client.instances().update(project=project, zone=zone, instance=instance_name, body={'metadata': metadata}).execute()

resource "google_compute_firewall" "mysql_restricted" {
  name    = "mysql-restricted"
  network = google_compute_network.VPC_NETWORK_NAME.self_link
  project = "GCP_PROJECT_ID"

  direction = "INGRESS"

  # Allow MySQL ports ONLY from approved IP ranges
  source_ranges = [
    "OFFICE_CIDR_BLOCK",   # e.g. "203.0.113.0/24"
    "BASTION_HOST_IP/32",  # e.g. "198.51.100.10/32"
  ]

  allows {
    protocol = "tcp"
    ports    = ["3306", "4333"]
  }

  # Optionally restrict by target tags or service accounts
  # target_tags = ["mysql-server"]
  # target_service_accounts = ["MYSQL_SERVER_SA@GCP_PROJECT_ID.iam.gserviceaccount.com"]

  description = "Restrict MySQL ports 3306 and 4333 to known IP addresses"
}

• VPC_NETWORK_NAME with the Terraform resource name or your existing network (google_compute_network.main, etc.).
• GCP_PROJECT_ID with your project ID.
• OFFICE_CIDR_BLOCK/BASTION_HOST_IP/32 with the specific trusted CIDR blocks/IPs that are allowed to reach MySQL.

• has allows covering tcp ports 3306/4333, and
• uses source_ranges = ["0.0.0.0/0"] (or other overly broad ranges),