# Cloud SQL No Maintenance Window Configured

> ZopNight flags a Cloud SQL instance when its settings carry no maintenanceWindow block, meaning Google may apply updates at any hour. Detection is inferred from absence: the discoverer stamps the window flag only when one is configured. RC-1241 is a medium-severity, $0 compliance finding. The fix is picking a low-traffic window.

Source: https://zop.dev/integrations/gcp/recommendations/cloud-sql-no-maintenance-window-configured
Updated: 2026-08-19

---

## A window nobody scheduled

Cloud SQL applies mandatory maintenance (engine patches, security fixes, infrastructure
updates) whether or not you pick a time for it. The maintenance window setting does not opt
you out; it only decides *when* the brief restart happens. An instance with no window
configured hands that decision to Google, which is how a production database ends up
restarting mid-morning on a weekday. The finding carries no dollar value: the exposure is an
unplanned interruption at the worst plausible hour, not a line item.

## How ZopNight decides, and where it abstains

Detection is inferred from absence, and the rule says so honestly. ZopNight's discoverer
inspects each instance's settings during the Cloud Asset Inventory sweep and stamps a
metadata marker only when a `maintenanceWindow` block is actually present. The marker is
never written as false. The rule therefore fires when an instance was genuinely enriched as
Cloud SQL but the marker is missing. To keep that inference safe, it first checks an anchor
key the enricher stamps on every Cloud SQL instance unconditionally; a resource that never
went through enrichment abstains rather than firing on incomplete data.

## The metadata quirk behind the detection

One implementation detail worth knowing if you read ZopNight's raw resource metadata: the
marker recording window presence is named `auto_minor_upgrade_enabled`, a name borrowed from
the equivalent RDS concept. On GCP it encodes exactly one fact: a maintenance window block
exists in the instance settings. An earlier version of this rule read a customer label that
no producer ever wrote, so it could never fire; the current gate reads the
provider-authoritative settings instead.

## Check an instance from your terminal

```bash
gcloud sql instances describe INSTANCE_NAME \
  --format="value(settings.maintenanceWindow)"
```

Empty output means no window is set. ZopNight reaches the same fact with read-only access:
`cloudsql.instances.list` inside `roles/cloudsql.viewer`, with bulk discovery under
`roles/cloudasset.viewer`.

## Picking a window that costs you nothing

Choose the quietest hour you have, for most teams a weekend early morning, and set the
timing preference so non-urgent updates land later in the release rollout rather than
earlier. The whole remediation is one edit on the instance's maintenance tab, takes effect
immediately, and clears the finding on the next discovery pass. There is no downtime in
making the change itself; the only restart is the one Google was going to do anyway, now on
your schedule.