Ensure that "log_min_duration_statement" database flag is set to -1 (i.e. disabled) for all your Google Cloud PostgreSQL database instances.
The "log_min_duration_statement" configuration flag causes the duration of each completed SQL statement to be logged if the statement executes for at least the specified number of milliseconds. Setting this flag to 0 logs all statement durations, whereas setting it to -1 disables logging statement durations. Logging SQL statements may include sensitive information that should not be recorded in log files, therefore the "log_min_duration_statement" database flag should be disabled.
Note: Some database flag settings can affect instance availability and/or stability, and eventually remove the PostgreSQL instance from the Google Cloud SQL Service Level Agreement (SLA).
To determine if "log_min_duration_statement" flag is disabled for your Google Cloud PostgreSQL database instances, perform the following actions:
Remediation / Resolution
To turn off the "log_min_duration_statement" database flag for your Google Cloud Platform (GCP) PostgreSQL database instances, perform the following actions:
- Google Cloud Platform (GCP) Documentation
- Cloud SQL for PostgreSQL
- Configuring database flags
- Editing instances
- CIS Security Documentation
- Securing Google Cloud Computing Platform
- PostgreSQL Database Documentation
- 19.8. Error Reporting and Logging
Unlock the Remediation Steps
Gain free unlimited access
to our full Knowledge Base
Over 750 rules & best practices
You are auditing:
Disable "log_min_duration_statement" Flag for PostgreSQL Database Instances
Risk level: Medium