# Ensure Database Authorized IPs Are Restricted

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826031756595-ensure-database-authorized-ips-are-restricted
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure each Public Cloud Database service allows connections only from specific, trusted IP addresses or CIDR ranges, such as application servers or VPNs, and that no authorized entry allows the whole internet (0.0.0.0/0).

**Rationale**

A database reachable from any IP address is exposed to password attacks and exploitation of any vulnerability. Allowing only known sources adds a network barrier in front of the database, so even a leaked password cannot be used from unknown networks.

**Impact**

-   Only trusted sources can connect
    
-   Reduces exposure to attacks from the internet
    
-   New application servers must be added to the list
    

**Default Value**

By default, no IP is authorized, so nobody can connect to the service until at least one IP is added. OVHcloud notes that 0.0.0.0/0 should only be used for troubleshooting.

**Pre-Requisites**

-   Permission to manage the database service
    
-   A list of IP addresses or ranges that need access
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Databases (under Databases & Analytics), then click the database service to open it.
    
4.  Open the Configuration tab and review the authorized IP addresses.
    
5.  If any entry allows 0.0.0.0/0 or overly broad ranges, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Databases (under Databases & Analytics), then click the database service to open it.
    
4.  Open the Configuration tab, enter each specific IP address or CIDR block with a description, and click the + button.
    
5.  Delete any entry that allows 0.0.0.0/0 or ranges that are no longer needed, using the ⋯ button in the IP table.
    
6.  Confirm that applications can still connect.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Databases (under Databases & Analytics), then click the database service to open it.
    
4.  Open the Configuration tab and add back the removed entries.
    

**Reference**

-   [https://docs.ovhcloud.com/en/guides/public-cloud/databases/faq](https://docs.ovhcloud.com/en/guides/public-cloud/databases/faq)
    
-   [https://help.ovhcloud.com/csm/en-public-cloud-databases-mysql-configure-instance?id=kb\_article\_view&sysparm\_article=KB0049234](https://help.ovhcloud.com/csm/en-public-cloud-databases-mysql-configure-instance?id=kb_article_view&sysparm_article=KB0049234)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.