# Ensure Database must enforce IP restriction rules (trusted_hosts) to prevent unrestricted access.

- Source: https://support.icompaas.com/support/solutions/articles/a_1786023032180700-ensure-database-must-enforce-ip-restriction-rules-trustedhosts-to-prevent-unrestricted-access
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Utho Cloud](https://support.icompaas.com/support/solutions/c_1786022244474917) › [Utho Checks](https://support.icompaas.com/support/solutions/folders/utho-checks)
- Last updated: 2026-08-13
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

This check verifies that Utho Cloud-managed databases have IP restriction rules configured using trusted hosts or equivalent access controls. Database access should be limited to approved IP addresses, networks, or applications rather than being exposed to unrestricted sources. Restricting database access reduces the risk of unauthorized connections from untrusted networks.

  

Rationale:

Allowing database connections from unrestricted IP addresses increases the risk of unauthorized access and network-based attacks.

This check helps:

-   Restrict database access to trusted networks.
    
-   Reduce the database attack surface.
    
-   Prevent unauthorized Internet-based connections.
    
-   Support network access-control and least-privilege requirements.
    

  

Impact:

-   Reduces unauthorized access to database services.
    
-   Limits database exposure to approved networks.
    
-   Applications connecting from unapproved IP addresses may lose connectivity.
    
-   Incorrect trusted-host configuration can prevent legitimate applications from accessing the database.
    

  

Default Value:

Database access should be restricted to explicitly trusted IP addresses or CIDR ranges.

A database is considered non-compliant if its trusted-host or equivalent IP restriction configuration allows unrestricted access, such as 0.0.0.0/0, ::/0, or an equivalent unrestricted rule.

  

Pre-requisites:

-   Utho Cloud account.
    
-   Permissions to view managed database configurations.
    
-   Access to the Utho Cloud Console or Utho API.
    
-   At least one Utho managed database cluster.
    

  

Test Plan:

1.  Sign in to the Utho Cloud Console.
    
2.  Navigate to Databases.
    
3.  Select each database cluster.
    
4.  Review the network access or trusted-host configuration.
    
5.  Verify that only approved IP addresses or CIDR ranges are allowed.
    
6.  Confirm that unrestricted sources such as 0.0.0.0/0 or ::/0 are not configured.
    

  

Using the Utho API:

curl -s -X GET "https://api.utho.com/v2/databases" \\  
  -H "Authorization: Bearer $UTHO\_API\_TOKEN" \\  -H "Content-Type: application/json" | jq

Retrieve an individual database cluster:

curl -s -X GET "https://api.utho.com/v2/databases/<CLUSTER\_ID>" \\  
  -H "Authorization: Bearer $UTHO\_API\_TOKEN" \\  -H "Content-Type: application/json" | jq

Inspect the trusted\_hosts or equivalent IP restriction field.

Implementation Plan:

1.  Log in to the Utho Cloud Console.
    
2.  Navigate to Databases.
    

3.  Select the non-compliant database cluster.
    
4.  Open the network access or trusted-host settings.
    
5.  Remove unrestricted IP ranges such as 0.0.0.0/0 and ::/0.
    

6.  Add only the required trusted IP addresses or CIDR ranges.
    

7.  Save the configuration.
    
8.  Verify that authorized applications can still connect to the database.
    

  

Using the Utho API:

Update the database trusted-host configuration using the supported Utho database configuration API.

curl -s -X PUT "https://api.utho.com/v2/databases/<CLUSTER\_ID>" \\  
  -H "Authorization: Bearer $UTHO\_API\_TOKEN" \\  -H "Content-Type: application/json" \\  -d '{"trusted\_hosts":\["203.0.113.10/32"\]}' | jq

Confirm the exact Utho API endpoint and request field for trusted\_hosts before implementing the remediation, as the available fields may vary by database engine and API version.

  

Backout Plan:

1.  Log in to the Utho Cloud Console.
    
2.  Navigate to Databases.
    
3.  Select the modified database cluster.
    
4.  Restore the previous trusted-host configuration if legitimate connectivity is interrupted.
    
5.  Verify application connectivity.
    
6.  Replace broad access with the correct trusted IP ranges instead of allowing unrestricted access.
    

  

References:

-   [Utho Cloud Database Documentation](https://utho.com/docs/products/database/?utm_source=chatgpt.com)
    
-   [Utho Cloud Documentation](https://utho.com/docs/?utm_source=chatgpt.com)
    
-   [Utho Cloud REST API](https://utho.com/rest-api/?utm_source=chatgpt.com)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.