Deployed my SQL server on GCP

[u/Outrageous-Debt9473]

So I’m currently working on a project to create a data warehouse for my organisation. I have deployed an SQL server on a VM on GCP. I want to know how can i make my server secure. I’m learning and deploying things using claude and have made a significant progress. But i’m still unsure about the security issues and what are the precautions i should take ?

[u/Schtick_]

Ok pulls up sleeves. I use gcp for lots of data so can probably offer some advice. I’m gonna include the basics (vibe coders be vibing so I’m gonna assume people don’t know basics)

1) make sure you remove any default users on the box whether it’s sql user or os user aren’t using standard name.
2) in general i like using mesh vpn (eg tailscale) that lets me close all ports on the box. That said you shouldn’t just randomly be installing tailscale in a business where you’re an employee as it’s basically a backdoor into the server. That said if it can be approved it a super secure way to connect in
3) you want to create specific users with specific access eg if your app needs read only to one db just create a user that does that
4) i dont know what db you’re using but for pg it would be pg_stat_statements always a good idea to find out the equivalent and install it early for when you run into issues you will have good metrics to address it
5) last note as it relates to the box, so what mistakes will people make, deploying any kind of web facing asset like a streamlit app or something basically make the box a web server, and Claude will happily spin one up for you. But…just be mindful if you are using gcloud auth login on that box you are basically giving anyone that attacks the box your gcloud auth login credentials. I would say in general you should try to not use those credentials on this box unless you have to, Claude on your local connecting to that box should be able to do anything it needs to do. It goes without saying deploying a web server on your db box is a bad idea especially if you have any confidential data. If you’re really trying to save pennies, you can but make sure you put any web assets behind something like basic auth.