Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Enable Automated Backups for Cloud SQL Database Instances

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Medium (should be achieved)
Rule ID: CloudSQL-002

Ensure that automated (scheduled) backups are created for all Cloud SQL database instances available within your Google Cloud Platform (GCP) account, in order to protect against data deletion and/or data corruption.

This rule resolution is part of the Conformity Security & Compliance tool for GCP.

Security

By default, automated backups are not configured for Cloud SQL instances. Automated backups provide a quick and efficient way to restore an SQL database instance to recover lost data or recover from a problem with that instance.


Audit

To determine if your Google Cloud SQL database instances are configured with automated backups, perform the following operations:

Using GCP Console

01 Sign in to Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 Navigate to Cloud SQL console available at https://console.cloud.google.com/sql/instances.

04 Click on the name (link) of the database instance that you want to examine.

05 In the navigation panel, select Backups to access the database backup configuration settings available for the selected instance.

06 In the Settings section, check the Automated backups feature configuration status. If the feature status is set to Disabled, automated database backups are not enabled for the selected Google Cloud SQL instance.

07 Repeat steps no. 4 – 6 for each Cloud SQL database instance deployed within the selected project.

08 Repeat steps no. 2 – 7 for each project deployed in your Google Cloud account.

Using GCP CLI

01 Run projects list command (Windows/macOS/Linux) using custom query filters to list the IDs of all the Google Cloud Platform (GCP) projects available in your Google Cloud account:

gcloud projects list
  --format="table(projectId)"

02 The command output should return the requested GCP project identifiers:

PROJECT_ID
cc-mobile-project-123123
cc-ml-app-project-123123

03 Run sql instances list command (Windows/macOS/Linux) with custom filtering to describe the name of each Cloud SQL database instance provisioned for the selected Google Cloud project:

gcloud sql instances list
  --project cc-mobile-project-123123
  --format="(NAME)"

04 The command output should return the requested database instance name(s):

NAME
	cc-mobile-db-instance
	cc-web-int-db-instance

05 Run sql instances describe command (Windows/macOS/Linux) using the name of the Cloud SQL database instance that you want to examine as the identifier parameter and custom query filters to describe the Automated Backups feature configuration status available for the selected database instance:

gcloud sql instances describe cc-mobile-db-instance
  --format="value(settings.backupConfiguration.enabled)"

06 The command output should return the requested configuration status (True for enabled, False for disabled):

False

If the sql instances describe command output returns False, as shown in the example above, database automated backups are not enabled for the selected Google Cloud SQL instance.

07 Repeat steps no. 5 and 6 for each Cloud SQL database instance provisioned in the selected project.

08 Repeat steps no. 3 – 7 for each project available within your Google Cloud account.

Remediation / Resolution

To enable and configure automated backups for your Google Cloud SQL database instances, perform the following operations:

Using GCP Console

01 Sign in to Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 Navigate to Cloud SQL console available at https://console.cloud.google.com/sql/instances.

04 Click on the name (link) of the database instance that you want to configure.

05 In the navigation panel, select Backups to access the database backup configuration settings available for the selected instance.

06 Choose EDIT from the Settings section to modify the backup feature settings.

07 On the Edit backups settings configuration panel, perform the following actions:

  1. Select the Automate daily backups checkbox to enable the Automated Backups feature.
  2. For Number of backups, configure the number of backups to retain.
  3. For Backup window, choose a 4-hour backup window for your daily backups. The backup operation may continue outside the window until complete.
  4. Select ADVANCED OPTIONS and choose where to store your database backups.
  5. Select the Enable point-in-time recovery checkbox to enable the Point-in-Time Recovery feature.
  6. Choose SAVE to apply the configuration changes.

08 Repeat steps no. 4 – 7 to enable automated database backups for other Cloud SQL instances deployed within the selected project.

09 Repeat steps no. 2 – 8 for each project deployed in your Google Cloud account.

Using GCP CLI

01 Run sql instances patch command (Windows/macOS/Linux) using the name of the Cloud SQL database instance that you want to configure as the identifier parameter, to enable automated backups within the daily backup window set as value for the --backup-start-time parameter. The --backup-start-time parameter is specified in 24-hour time, in the UTC±00 time zone, and specifies the start of a 4-hour backup window. Database backups can start any time during the backup window specified:

gcloud sql instances patch cc-mobile-db-instance
  --backup-start-time 02:00 
  --retained-backups-count 30

02 The output should return the **sql instances patch** command request status:

The following message will be used for the patch API method.

{"name": "cc-mobile-db-instance", "project": "cc-mobile-project-123123", "settings": {"backupConfiguration": {"binaryLogEnabled": false, "enabled": true, "location": "us", "startTime": "02:00"}}}

Patching Cloud SQL instance...done.
Updated [https://sqladmin.googleapis.com/sql/v1beta4/projects/cc-mobile-project-123123/instances/cc-mobile-db-instance].

03 Repeat steps no. 1 and 2 to enable automated database backups for other Cloud SQL instances provisioned for the selected project.

04 Repeat steps no. 1 – 3 for each project created within your Google Cloud account.

References

Publication date Apr 12, 2021