Cloud SQL PostgreSQL: log_error_verbosity = default

Check ID: cloudsql_instance_postgres_log_error_verbosity_flag
Provider: GCP
Service: cloudsql
Severity: MEDIUM
Categories: logging
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL for PostgreSQL evaluates the log_error_verbosity database flag and expects the value default. Configurations using terse or verbose are flagged as deviations.

Risk

With verbose, logs may reveal SQLSTATE, code paths, and function details, aiding recon and leaking metadata (confidentiality). With terse, missing DETAIL/HINT/CONTEXT hinders detection and forensics, reducing integrity of investigations and availability of operational insight.

Recommendation

Set log_error_verbosity to default to balance data minimization and observability.

Avoid verbose in production; restrict log access (least privilege)
Avoid terse except briefly to curb noise
Centralize logs with retention and tamper protection for defense in depth

Remediation

CLI
Terraform
Dashboard steps

gcloud sql instances patch <INSTANCE_NAME> --database-flags=log_error_verbosity=default

resource "google_sql_database_instance" "main" {
  name             = "<example_resource_name>"
  region           = "<example_region>"
  database_version = "POSTGRES_14"

  settings {
    tier = "<example_machine_tier>"

    database_flags {
      name  = "log_error_verbosity"
      value = "default" # Critical: sets the flag to default to pass the check
    }
  }
}

References

https://cloud.google.com/sql/docs/postgres/flags

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_postgres_log_error_verbosity_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL PostgreSQL: log_disconnections = on Cloud SQL PostgreSQL: log_min_duration_statement = -1

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires