services / Google Cloud / Google Cloud SQL

SSL client certificates for connecting to a Cloud SQL instance. Each instance can have 10 client certificates.

Cloud SQL is used to store and serve sensitive and application-critical data. Breach of a cloud SQL database can lead to exfiltration of highly sensitive data, or interruption of mission-critical applications.


cloudsql.​sslCerts.​create

This permission allows creating a client SSL certificate for the instance, which allows the user to establish a connection to the instance. Note that authentication into the database is still separate, so this does not provide access to data.

Risks

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links

  • https:​/​/​cloud.​google.​com/​sql/​docs/​mysql/​iam-​permissions
  • https:​/​/​cloud.​google.​com/​sql/​docs/​mysql/​iam-​overview
  • https:​/​/​cloud.​google.​com/​sql/​docs/​mysql/​roles-​and-​permissions
  • Contributed by P0 Security

    © 2023–present P0 Security and contributors to the IAM Privilege Catalog