Ensure that the "log_statement" database flag configured for your Google Cloud PostgreSQL database instances has the appropriate value (logging level) in accordance with your organization's logging policy. The "log_statement" configuration flag controls which SQL statements are logged. The valid "log_statement" values are: none (disabled), ddl, mod, and all (all statements). ddl captures CREATE, ALTER, and DROP statements. mod captures ddl statements and data-modifying operations like INSERT, UPDATE, DELETE, TRUNCATE, and COPY FROM. Additionally, PREPARE, EXECUTE, and EXPLAIN ANALYZE statements are logged if their underlying commands are appropriate. For clients employing the extended query protocol, logging is triggered upon receipt of an Execute message, with Bind parameter values included, and any single-quote marks within them are doubled. Before running this conformity rule, select the value (level) used by the "log_statement" flag within your organization, in the Trend Micro Cloud One™ – Conformity account rule settings.
This rule resolution is part of the Conformity Security & Compliance tool for GCP.
PostgreSQL database auditing can help in troubleshooting operational issues and permit administrators to perform forensic analysis. An incorrect value for the "log_statement" flag can lead to excessive logging, making it difficult to find relevant information, or insufficient logging, missing crucial details. Therefore, the database flag value should be set in accordance with your organization's logging protocols.
Note: Some database flag settings can affect instance availability and/or stability, and eventually remove the PostgreSQL instance from the Google Cloud SQL Service Level Agreement (SLA).
Audit
To determine if the "log_statement" flag set for your Cloud PostgreSQL database instances has the appropriate configuration, perform the following operations:
Remediation / Resolution
To configure the "log_statement" flag value (logging level) in accordance with your organization's logging policy, perform the following operations:
References
- Google Cloud Platform (GCP) Documentation
- Cloud SQL for PostgreSQL documentation
- Configure database flags
- Edit instances
- CIS Security Documentation
- Google Cloud Computing Platform
- PostgreSQL Database Documentation
- Documentation
- GCP Command Line Interface (CLI) Documentation
- gcloud projects list
- gcloud sql instances list
- gcloud sql instances describe
- gcloud sql instances patch
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Configure "log_statement" Flag for PostgreSQL Database Instances
Risk Level: Medium