# 6.1.1 Ensure That a MySQL Database Instance Does Not Allow Anyone To Connect With Administrative Privileges (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000233029-6-1-1-ensure-that-a-mysql-database-instance-does-not-allow-anyone-to-connect-with-administrative-priv - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: - Level 1 ### Description: It is recommended to configure a password for the administrative user (typically root) on MySQL database instances. This ensures unauthorized users cannot connect with administrative privileges. This recommendation applies only to MySQL instances. For PostgreSQL, password configuration is not exposed through the cloud console. ### Rationale: When creating a MySQL database instance, not setting a password for the root user allows anyone to connect to the instance with administrative privileges. By assigning a secure password, only authorized users can access the database with administrative capabilities, reducing the risk of unauthorized access. ### Impact: Administrative clients must update their connection strings to include the password when accessing the database. Proper password management practices will be required. ### Default Value: By default, the MySQL instance creation workflow enforces a root password unless the No Password option is explicitly selected during instance setup. ### Audit Steps: #### Using Google Cloud CLI: List all MySQL database instances in the project: gcloud sql instances list --filter='DATABASE\_VERSION:MYSQL\*' --project --format="(NAME,PRIMARY\_ADDRESS)" Attempt to connect to each MySQL instance using its IP address: mysql -u root -h 1. Expected Results: If the command prompts for a password or returns an error such as: ERROR 1045 (28000): Access denied for user 'root'@'' (using password: NO) - This indicates the root user requires a password. - If the mysql> prompt is returned, it means the root user has no password, and the instance is vulnerable. ### Remediation Steps: #### From Google Cloud Console: 1. Navigate to the [Cloud SQL Instances page](https://console.cloud.google.com/sql/). ![](https://support.icompaas.com/assets/kb/252238fe958993b7.png) 2. Select the target MySQL instance to open its Overview ![](https://support.icompaas.com/assets/kb/58d9ec27b6a61cd4.png) 3. Go to Access Control > Users. ![](https://support.icompaas.com/assets/kb/096bde56728caf3d.png) 4. Locate the administrative user (e.g., root). ![](https://support.icompaas.com/assets/kb/e4802dbb7464b174.png) 5. Click the More actions icon next to the user and select Change password. ![](https://support.icompaas.com/assets/kb/51062540dc311653.png) 6. Enter a secure password and click OK. ![](https://support.icompaas.com/assets/kb/2f5cefba7d3afc1d.png) #### From Google Cloud CLI: Set a password for the root user on the MySQL instance: gcloud sql users set-password root --host= --instance= --prompt-for-password Enter the new password when prompted: Instance Password: Confirm the success message: Updating Cloud SQL user...done. **Backout plan:** - Revert User Privileges (if privileges were mistakenly removed): To restore privileges for an authorized administrative user: gcloud sql users set-privileges \[USER\_NAME\] --instance=\[INSTANCE\_NAME\] --privileges=SUPER Alternatively, you can add specific privileges (like `ALL PRIVILEGES` for the required user):` ` gcloud sql users set-privileges \[USER\_NAME\] --instance=\[INSTANCE\_NAME\] --privileges="ALL PRIVILEGES" - Review User Access: - After restoring access, run the following to verify: gcloud sql users list --instance=\[INSTANCE\_NAME\] - Ensure the users have the required privileges. 2. Reconfigure User Access: If the previous configuration was overly restrictive or needs adjustment, you can modify user roles again through the Cloud SQL console or CLI. 3. Notify Stakeholders: - Inform relevant teams that administrative privileges have been reverted. - Review IAM and access policies to ensure only authorized users have administrative privileges. ### References: 1. [Google Cloud SQL Documentation - Managing MySQL Users](https://cloud.google.com/sql/docs/mysql/create-manage-users) 2. [Google Cloud SQL Documentation - Creating MySQL Instances](https://cloud.google.com/sql/docs/mysql/create-instance) ### CIS Controls:

Control	Description	IG 1	IG 2	IG 3
4.7 Manage Default Accounts	Manage default accounts, including root and other pre-configured vendor accounts. This includes disabling or securing them to prevent unauthorized access.	✅	✅	✅
4.2 Change Default Passwords	Ensure all default passwords are changed before deploying new assets. Set passwords consistent with the security requirements for administrative accounts.	✅	✅	✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.