Cloud SQL instances with no maintenance window in settings
What does ZopNight detect here?
ZopNight flags a Cloud SQL instance when its settings carry no maintenanceWindow block, meaning Google may apply updates at any hour. Detection is inferred from absence: the discoverer stamps the window flag only when one is configured. RC-1241 is a medium-severity, $0 compliance finding. The fix is picking a low-traffic window.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1241 |
| Category | compliance |
| Severity | medium |
| Metric | none — pure configuration read |
| Source | cloudsql_maintenance.go |
Where it applies
A window nobody scheduled
Cloud SQL applies mandatory maintenance (engine patches, security fixes, infrastructure updates) whether or not you pick a time for it. The maintenance window setting does not opt you out; it only decides when the brief restart happens. An instance with no window configured hands that decision to Google, which is how a production database ends up restarting mid-morning on a weekday. The finding carries no dollar value: the exposure is an unplanned interruption at the worst plausible hour, not a line item.
How ZopNight decides, and where it abstains
Detection is inferred from absence, and the rule says so honestly. ZopNight’s discoverer
inspects each instance’s settings during the Cloud Asset Inventory sweep and stamps a
metadata marker only when a maintenanceWindow block is actually present. The marker is
never written as false. The rule therefore fires when an instance was genuinely enriched as
Cloud SQL but the marker is missing. To keep that inference safe, it first checks an anchor
key the enricher stamps on every Cloud SQL instance unconditionally; a resource that never
went through enrichment abstains rather than firing on incomplete data.
The metadata quirk behind the detection
One implementation detail worth knowing if you read ZopNight’s raw resource metadata: the
marker recording window presence is named auto_minor_upgrade_enabled, a name borrowed from
the equivalent RDS concept. On GCP it encodes exactly one fact: a maintenance window block
exists in the instance settings. An earlier version of this rule read a customer label that
no producer ever wrote, so it could never fire; the current gate reads the
provider-authoritative settings instead.
Check an instance from your terminal
gcloud sql instances describe INSTANCE_NAME \ --format="value(settings.maintenanceWindow)"Empty output means no window is set. ZopNight reaches the same fact with read-only access:
cloudsql.instances.list inside roles/cloudsql.viewer, with bulk discovery under
roles/cloudasset.viewer.
Picking a window that costs you nothing
Choose the quietest hour you have, for most teams a weekend early morning, and set the timing preference so non-urgent updates land later in the release rollout rather than earlier. The whole remediation is one edit on the instance’s maintenance tab, takes effect immediately, and clears the finding on the next discovery pass. There is no downtime in making the change itself; the only restart is the one Google was going to do anyway, now on your schedule.