Link in English: https://cloud.google.com/security-command-center/docs/how-to-remediate-security-health-analytics-findings#open_mysql_port

Open MySQL port Category name in the API: OPEN_MYSQL_PORT Firewall rules that allow any IP address to connect to MySQL ports might expose your MySQL services to attackers. For more information, see VPC firewall rules overview. The MySQL service ports are: TCP - 3306 This finding is generated for vulnerable firewall rules, even if you intentionally disable the rules. Active findings for disabled firewall rules alert you to unsafe configurations that will allow undesired traffic if enabled. To remediate this finding, complete the following steps: Go to the Firewall page in the Google Cloud console. Go to Firewall In the list of firewall rules, click the name of the firewall rule in the finding. Click edit Edit. Under Source IP ranges, delete 0.0.0.0/0. Add specific IP addresses or IP ranges that you want to let connect to the instance. Add specific protocols and ports you want to open on your instance. Click Save.

we can all use Gen AI to get answers, but sometime even they give a wrong one or when prompted to change, they'll just go with whatever you're saying which is no reliable. Please provide a an official link along with the answer to verify. this does not help anyone.

Here's why Option B is the recommended choice: Hierarchical Firewall Policy: A hierarchical firewall policy set at the organization level allows for centralized control and management of firewall rules across all projects within the organization. This ensures consistent security policies and makes it easier to enforce changes uniformly. Allow Internal IP Ranges: By configuring the firewall policy to allow connections only from internal IP ranges, you are implementing a "default deny" rule for external traffic, which is a security best practice. This effectively blocks traffic from 0.0.0.0/0 (anywhere), helping to prevent open ports and unauthorized access.