GCP Firewall rule allows all traffic on MySQL DB port (3306) misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_88
Category - Subcategory	Public Exposure - Sensitive Ports
Provider	GCP
Severity	LOW
Framework	Terraform
Mapped CSPM/KSPM Rule	1171a9b9-9648-405a-8e03-83e5025e81d3

Impact

It is a best practice to ensure that your firewall ingress rules do not allow unrestricted access to your MySQL database, as it can increase the risk of unauthorized access or attacks on your database. By restricting access to only specific IP addresses or ranges that you trust, you can help secure your database from potential threats. Additionally, you can use tools like SSL/TLS to encrypt the connection between your database and client, which can help protect against interception of sensitive data.

How to Fix

[source,go]

{ "resource "google_compute_firewall" "restricted" { name = "example" network = "google_compute_network.vpc.name"

allow { protocol = "tcp" ports = ["3306"] }

source_ranges = ["172.1.2.3/32"] }

", }