Cloud SQL PostgreSQL: log_disconnections = on

Check ID: cloudsql_instance_postgres_log_disconnections_flag
Provider: GCP
Service: cloudsql
Severity: MEDIUM
Categories: logging
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL for PostgreSQL instances have the log_disconnections flag set to on, creating a record each time a client session ends, including its duration and status

Risk

Without disconnection logs, session lifecycles lack visibility, obscuring credential misuse, session hijacking, and short-lived data exfiltration. Weak audit trails hinder correlation and forensics, undermining confidentiality and integrity and slowing incident response.

Recommendation

Enable log_disconnections=on to ensure complete session auditing.

Pair with log_connections and a consistent log_line_prefix
Centralize and retain logs; alert on anomalies
Apply defense in depth with routine review of access and audit events

Remediation

CLI
Terraform
Dashboard steps

gcloud sql instances patch <example_resource_name> --database-flags=log_disconnections=on

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<REGION>"
  database_version = "POSTGRES_14"

  settings {
    tier = "<TIER>"

    # Critical: enable disconnect logging
    database_flags {
      name  = "log_disconnections"  # sets the required flag
      value = "on"                   # ensures the check passes
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_postgres_log_disconnections_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL PostgreSQL: log_connections = on Cloud SQL PostgreSQL: log_error_verbosity = default

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires