# 6.1.2 Ensure ‘Skip_show_database’ Database Flag for Cloud SQL MySQL Instance Is Set to ‘On’ (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233030-6-1-2-ensure-skip-show-database-database-flag-for-cloud-sql-mysql-instance-is-set-to-on-automate - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability: Level 1 Description: The skip\_show\_database database flag for Cloud SQL MySQL instances should be set to ON. This configuration prevents users without the SHOW DATABASES privilege from listing all databases, thus enhancing database security. Rationale: Enabling the skip\_show\_database flag limits the visibility of databases to users who lack the necessary privileges. By default, users without the SHOW DATABASES privilege may still see the databases for which they have other permissions. Activating this flag ensures that only authorized users can view database names, reducing the risk of information exposure or unauthorized access. Impact: Enabling this flag restricts users from seeing databases unless they possess the required SHOW DATABASES privilege. The configuration change will restart the database instance, which may temporarily disrupt availability. Default Value: When creating a MySQL database instance, the skip\_show\_database flag is not enabled by default. Audit Steps: #### From Google Cloud Console: 1. Open the [Cloud SQL Instances](https://console.cloud.google.com/sql/instances) page.                              ![](https://support.icompaas.com/assets/kb/9e81549036f76bd2.png) 2. Select the MySQL instance to open its Overview page.               ![](https://support.icompaas.com/assets/kb/65075337aa2955b9.png) 3. Under the Database Flags section, confirm that the skip\_show\_database flag is set and its value is ON.         ![](https://support.icompaas.com/assets/kb/e7adde5d9257bc3c.png) From Google Cloud CLI: List all Cloud SQL instances: gcloud sql instances list Verify that the skip\_show\_database flag is set to ON: gcloud sql instances describe --format=json | jq '.settings.databaseFlags\[\] | select(.name=="skip\_show\_database")|.value' The expected output should display: "On" Remediation Steps: #### From Google Cloud Console: 1. Navigate to the [Cloud SQL Instances](https://console.cloud.google.com/sql/instances) page.                                     ![](https://support.icompaas.com/assets/kb/36bed217ffdb564f.png) 2. Select the MySQL instance for which you want to enable the skip\_show\_database flag.                ![](https://support.icompaas.com/assets/kb/33caf4c023fe3bde.png) 3. Click Edit.                ![](https://support.icompaas.com/assets/kb/89ec0d19be7e33e9.png) 4. Scroll to the Flags section.                       ![](https://support.icompaas.com/assets/kb/8fbd4b0adca3fff0.png) 5. Click Add a Database Flag, select skip\_show\_database from the dropdown, and set its value to ON.                           ![](https://support.icompaas.com/assets/kb/d83823da3fb76814.png)           ![](https://support.icompaas.com/assets/kb/22be875981c5ca22.png) 6. Save the changes.                             ![](https://support.icompaas.com/assets/kb/6395fe320e50dd08.png) 7. Confirm the updated flag under the Flags section on the instance’s Overview page.           ![](https://support.icompaas.com/assets/kb/454727df7611c6d2.png) #### From Google Cloud CLI: List all Cloud SQL instances: gcloud sql instances list Configure the skip\_show\_database flag for each MySQL instance: gcloud sql instances patch --database-flags skip\_show\_database=on 1. Note: This command overwrites all previously set database flags. To retain existing flags, include them in the command. ### Backout Plan: Revert the skip-show-database flag to off (if needed): To revert the change, run the following command: gcloud sql instances patch \[INSTANCE\_NAME\] --database-flags "skip-show-database=off" Verify the flag configuration: Run the following command again to ensure that the flag is properly configured: gcloud sql instances describe \[INSTANCE\_NAME\] --format=json | jq '.settings.databaseFlags\[\] | select(.name=="skip-show-database")|.value' Notify stakeholders: - Inform the relevant teams about the backout process and any impact on the system or applications relying on database visibility. Review the audit logs to confirm changes: gcloud logging read "protoPayload.methodName='google.cloud.sql.v1beta4.SqlInstancesPatch'" References: 1. [Google Cloud SQL - Database Flags](https://cloud.google.com/sql/docs/mysql/flags) 2. [MySQL Documentation -](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_skip_show_database) [skip\_show\_database](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_skip_show_database) Additional Information: - Configuring this flag will restart the Cloud SQL instance, causing potential temporary unavailability. - Some database flags may impact instance availability or stability and could remove the instance from the Cloud SQL SLA. Refer to the [Operational Guidelines](https://cloud.google.com/sql/docs/mysql/flags). CIS Controls:

Control

Description

IG 1

IG 2

IG 3

3.3 Configure Data Access Control Lists

Restrict access to data by configuring access control lists, ensuring that only authorized users can access local and remote file systems, databases, or applications.

✅

✅

✅

14.6 Protect Information through Access Control Lists

Protect all stored information by enforcing access control lists that limit access to only authorized individuals based on responsibilities and access needs.

✅

✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.