🔷CIS GCP 6.2Rule: GCP-SQL-002high

Ensure Cloud SQL backups are configured

Description

Automated backups must be enabled for all Cloud SQL instances.

⚠️ Risk Impact

Without backups, data loss from accidental deletion, corruption, or ransomware is permanent.

🔍 How EchelonGraph Detects This

GCP-SQL-002Automated scanner rule

EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected Google Cloud accounts. Violations are flagged as high-severity findings with remediation guidance.

🖥️ Manual Verification

terminal
gcloud sql instances describe INSTANCE --format='value(settings.backupConfiguration.enabled)'

🔧 Remediation

Enable automated backups: gcloud sql instances patch INSTANCE --backup-start-time=02:00

💀 Real-World Attack Scenario

A ransomware attack encrypted all production Cloud SQL databases. Without automated backups, the organization faced a choice: pay the $1.8M ransom or lose all customer data. They paid, but only 60% of data was recoverable from the decryption keys provided by the attackers.

💰 Cost of Non-Compliance

Average ransomware recovery without backups: $2.3M (payment + downtime). With backups: $165K (restoration + minor downtime). RPO violations can trigger SLA penalties of $10K-$500K depending on contract terms.

📋 Audit Questions

  • 1.Show backup configuration for all Cloud SQL instances.
  • 2.What is the backup retention period?
  • 3.When was the last backup restoration test?
  • 4.Are backups stored in a different region from the primary instance?

🎯 MITRE ATT&CK Mapping

T1486 — Data Encrypted for ImpactT1485 — Data Destruction

🏗️ Infrastructure as Code Fix

main.tf
resource "google_sql_database_instance" "main" {
  settings {
    backup_configuration {
      enabled                        = true
      start_time                     = "02:00"
      point_in_time_recovery_enabled = true
      transaction_log_retention_days = 7
      backup_retention_settings {
        retained_backups = 30
      }
    }
  }
}

⚡ Common Pitfalls

  • ⛔Enabling backups but never testing restore procedures
  • ⛔Not enabling point-in-time recovery for transaction-level RPO
  • ⛔Storing backups in the same region as the primary (disaster recovery gap)

📈 Business Value

Automated backups with tested recovery procedures reduce ransomware impact by 93%. They provide the ultimate insurance against data loss — turning a potential $2M+ incident into a minor operational event.

⏱️ Effort Estimate

Manual

30 minutes per instance to configure; 2-4 hours quarterly for restore testing

With EchelonGraph

EchelonGraph verifies backup configuration across all instances continuously

🔗 Cross-Framework References

SOC2-CC7.5ISO27001-A.12.3.1

Automate CIS GCP 6.2 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →