Check ID: cloudsql_instance_postgres_enable_pgaudit_flag
Provider: GCP
Service: cloudsql
Severity: HIGH
Categories: logging, forensics-ready
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL for PostgreSQL instances are evaluated for the database flag cloudsql.enable_pgaudit being set to on

Risk

Without cloudsql.enable_pgaudit, database activity lacks granular audit trails. Undetected reads/writes enable insider abuse, credential reuse, or SQL injection without evidence, harming confidentiality and integrity. Poor traceability slows incident response, forensics, and undermines compliance.

Recommendation

Enable cloudsql.enable_pgaudit and configure pgAudit to log required classes (e.g., read, write, ddl) under least privilege. Centralize logs, enforce retention and RBAC, and monitor with alerts. Scope auditing to sensitive data to reduce noise and overhead, and review coverage regularly.

Remediation

gcloud sql instances patch <example_resource_id> --database-flags cloudsql.enable_pgaudit=on

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_postgres_enable_pgaudit_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks