---
title: >-
  SQL Database instances should only allow ingress traffic from specific IP
  addresses
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > SQL Database instances should only
  allow ingress traffic from specific IP addresses
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# SQL Database instances should only allow ingress traffic from specific IP addresses
 
## Description{% #description %}

This rule fails when a Cloud SQL instance with a public IP address lists `0.0.0.0` or `0.0.0.0/0` in its authorized networks, which allows connections to the database from any address on the internet. Private-IP-only instances are out of scope and pass, even when they list `0.0.0.0/0`. An instance counts as private-IP-only only when `ipv4_enabled` is `false` and it has no `PRIMARY` IP address. An instance fails, even with only restricted authorized networks, when it cannot be classified: it has neither `ipv4_enabled` nor a `PRIMARY` address, an authorized network has no value, or an IP address has no type. This differs from the CIS audit, which fails on `0.0.0.0/0` regardless of public IP. Authorized networks still apply to private IP connections from clients with non-RFC 1918 addresses, so on a passing private-IP-only instance `0.0.0.0/0` removes source restrictions for those clients, and for internet clients if a public IP is enabled later.

## Remediation{% #remediation %}

1. Remove `0.0.0.0/0` from the instance's authorized networks and add only the addresses that need access by following [Authorize with authorized networks](https://docs.cloud.google.com/sql/docs/mysql/authorize-networks).
1. To block open authorized networks across a project, folder, or organization, enforce the `constraints/sql.restrictAuthorizedNetworks` constraint described in [Cloud SQL organization policies](https://docs.cloud.google.com/sql/docs/mysql/org-policy/org-policy).

## References{% #references %}

- [Configure public IP](https://docs.cloud.google.com/sql/docs/mysql/configure-ip)
- [CIS Google Cloud Platform Foundation Benchmark](https://www.cisecurity.org/benchmark/google_cloud_computing_platform)