Cloud SQL PostgreSQL: log_connections = on

Check ID: cloudsql_instance_postgres_log_connections_flag
Provider: GCP
Service: cloudsql
Severity: MEDIUM
Categories: logging
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL for PostgreSQL instances have the log_connections flag set to on, causing the server to record every connection attempt and the result of client authentication.

Risk

Without connection logs, unauthorized access attempts can go unnoticed. Attackers may brute-force or reuse credentials without audit evidence, enabling stealthy data access (confidentiality), changes via compromised accounts (integrity), and connection floods that impact service (availability).

Recommendation

Enable log_connections=on for all PostgreSQL instances.

Apply defense in depth: also capture disconnects and audit events
Centralize logs, retain them, and alert on anomalies
Enforce least privilege and strong authentication to reduce exposure and improve detection

Remediation

CLI
Terraform
Dashboard steps

gcloud sql instances patch <INSTANCE_NAME> --database-flags=log_connections=on

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  database_version = "POSTGRES_14"
  region           = "<region>"

  settings {
    tier = "db-f1-micro"

    # Critical: enables connection logging to pass the check
    database_flags {
      name  = "log_connections"  # critical
      value = "on"                # critical
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_postgres_log_connections_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL PostgreSQL: cloudsql.enable_pgaudit = on Cloud SQL PostgreSQL: log_disconnections = on

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires