Mysql – Should I enable SSL on the MySQL database with Cloud SQL

databasegoogle-cloud-sqlMySQLssl

I was wondering if I should enable SSL with my Cloud SQL (Google Cloud Platform) instance. I communicate with the database via a Laravel (PHP) application and specified that the IP address of my server (hosted on DigitalOcean) only has access to the Cloud SQL instance.

My thought was, even if I enable SSL, anyone who has access to the server can query the database in some sort of way, because the SSL certificates are on the server. So does enabling SSL make any sense? Does it make it more secure? Or is it safe to be off?

Thanks for your time and answers.

Best Answer

Using SSL is critical if you don't want anyone to watch or intercept your traffic. Secure connection enables you to hide your DB queries and transactions. This can be determined by your application and type of data you are exchanging and whether you trust the network or not.

Related Solutions

Google Cloud SQL authorize Auto Scale Instance Groups

As already mentioned by @justbeez, I believe the best way to go is using second generation instances and Cloud SQL Proxy. In case this is not possible, first generation instances can be setup to only allow SSL connections and whitelisting any origin as explained here.

A more complex approach would be to create an instance template so that a startup-script runs at boot time and authorizes the instance IP address via gcloud. The IP could be removed in the same way at shutdown time.

The IP address of the GCE VM can be obtained from the metadata server

curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip" -H "Metadata-Flavor: Google"

Mysql – Passwordless user for Google Cloud SQL (MySQL) using Cloud SQL Proxy

Basically, it seems like the Cloud SQL Proxy does not enable authenticating to a specific MySQL user via an IAM Service Account. Is this correct?

That is correct. The Cloud SQL Proxy doesn't offer any mechanisms for restricting which MySQL users you have access to when you connect using the proxy. Connections made through the proxy are only restricted by whatever IAM roles are assigned to them. The mechanism for restricting which accounts can access which users is to use password protection.

Best Answer

Related Solutions

Google Cloud SQL authorize Auto Scale Instance Groups

Mysql – Passwordless user for Google Cloud SQL (MySQL) using Cloud SQL Proxy

Related Topic