Cloud SQL Proxy Hardening

中文版
CloudSQL Proxy Hardening Encryptor: https://github.com/Funny-Systems-OSS/CloudSQL-Proxy-Hardening-Encryptor

• Problem and Solution
• Features
• Requirements
• Installation
• Usage
• Todo

Problem and Solution

Features

• Replace plain credential file with encrypted one which bound to instance ID.
• Compare with original Cloud SQL Proxy Software | Google Cloud SQL Proxy | Cloud SQL Proxy Hardening (OSS Edition) | Cloud SQL Proxy Hardening (Enterpise Edition) ---------------------|-------------------------|-----------------------------------------|---------------------------------------------- Credential File | Plaintext | Ciphertext | Ciphertext Bind with Instance | No | Yes | Yes Support Auto-Scaling | No | No | Yes Authentication | Service Account | Serivce Account & Instance ID | ENHANCED
• For more infomation ? Contact oss@funny.systems

Requirements

• Go 1.15 or higher.

Fork from

cloudsql-proxy: https://github.com/GoogleCloudPlatform/cloudsql-proxy/tree/v1.19.0

Installation

1. git clone https://github.com/Funny-Systems-OSS/cloudsql-proxy-hardening.git
2. cd ./cloudsql-proxy-hardening
3. go build -o ../cloud_sql_proxy_funny ./cmd/cloud_sql_proxy/

Usage

• ./cloud_sql_proxy_funny <-credential_file credential_file_path> [-use_plainfile]
  • -credential_file:
    The encrypted credential file be used to retrieve Service Account credential in cloud_sql_proxy_funny.
  • -use_plainfile:
    Setting this flag will allow you to use plainfile.

Todo

• Act as classic cloud_sql_proxy if not in debug mode.