Check ID:
Provider: GCP
Service:
Severity: HIGH
Categories:
Resource type:
cloudsql_instance_postgres_enable_pgaudit_flagProvider: GCP
Service:
cloudsqlSeverity: HIGH
Categories:
logging, forensics-readyResource type:
sqladmin.googleapis.com/InstanceWhat this check verifies
Cloud SQL for PostgreSQL instances are evaluated for the database flagcloudsql.enable_pgaudit being set to on
Risk
Withoutcloudsql.enable_pgaudit, database activity lacks granular audit trails. Undetected reads/writes enable insider abuse, credential reuse, or SQL injection without evidence, harming confidentiality and integrity. Poor traceability slows incident response, forensics, and undermines compliance.
Recommendation
Enablecloudsql.enable_pgaudit and configure pgAudit to log required classes (e.g., read, write, ddl) under least privilege. Centralize logs, enforce retention and RBAC, and monitor with alerts. Scope auditing to sensitive data to reduce noise and overhead, and review coverage regularly.
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudSQL/postgre-sql-audit-flag.html
- https://cloud.google.com/sql/docs/postgres/flags
- https://cloud.google.com/sql/docs/postgres/pg-audit
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = cloudsql_instance_postgres_enable_pgaudit_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks