Skip to main content
compliance · gcp

Cloud SQL instances with no maintenance window in settings

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

ZopNight flags a Cloud SQL instance when its settings carry no maintenanceWindow block, meaning Google may apply updates at any hour. Detection is inferred from absence: the discoverer stamps the window flag only when one is configured. RC-1241 is a medium-severity, $0 compliance finding. The fix is picking a low-traffic window.

Signal and threshold

How ZopNight evaluates Cloud SQL instances with no maintenance window in settings.
Field Value
Rule IDsRC-1241
Categorycompliance
Severitymedium
Metricnone — pure configuration read
Sourcecloudsql_maintenance.go

A window nobody scheduled

Cloud SQL applies mandatory maintenance (engine patches, security fixes, infrastructure updates) whether or not you pick a time for it. The maintenance window setting does not opt you out; it only decides when the brief restart happens. An instance with no window configured hands that decision to Google, which is how a production database ends up restarting mid-morning on a weekday. The finding carries no dollar value: the exposure is an unplanned interruption at the worst plausible hour, not a line item.

How ZopNight decides, and where it abstains

Detection is inferred from absence, and the rule says so honestly. ZopNight’s discoverer inspects each instance’s settings during the Cloud Asset Inventory sweep and stamps a metadata marker only when a maintenanceWindow block is actually present. The marker is never written as false. The rule therefore fires when an instance was genuinely enriched as Cloud SQL but the marker is missing. To keep that inference safe, it first checks an anchor key the enricher stamps on every Cloud SQL instance unconditionally; a resource that never went through enrichment abstains rather than firing on incomplete data.

The metadata quirk behind the detection

One implementation detail worth knowing if you read ZopNight’s raw resource metadata: the marker recording window presence is named auto_minor_upgrade_enabled, a name borrowed from the equivalent RDS concept. On GCP it encodes exactly one fact: a maintenance window block exists in the instance settings. An earlier version of this rule read a customer label that no producer ever wrote, so it could never fire; the current gate reads the provider-authoritative settings instead.

Check an instance from your terminal

Terminal window
gcloud sql instances describe INSTANCE_NAME \
--format="value(settings.maintenanceWindow)"

Empty output means no window is set. ZopNight reaches the same fact with read-only access: cloudsql.instances.list inside roles/cloudsql.viewer, with bulk discovery under roles/cloudasset.viewer.

Picking a window that costs you nothing

Choose the quietest hour you have, for most teams a weekend early morning, and set the timing preference so non-urgent updates land later in the release rollout rather than earlier. The whole remediation is one edit on the instance’s maintenance tab, takes effect immediately, and clears the finding on the next discovery pass. There is no downtime in making the change itself; the only restart is the one Google was going to do anyway, now on your schedule.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·