Cloud SQL PostgreSQL: log_min_duration_statement = -1

Check ID: cloudsql_instance_postgres_log_min_duration_statement_flag
Provider: GCP
Service: cloudsql
Severity: MEDIUM
Categories: logging
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL for PostgreSQL evaluates whether log_min_duration_statement is set to -1, disabling statement duration logging.

Risk

When duration-based statement logging is enabled, logs can capture full SQL with literals, exposing confidential data in log stores. Adversaries or over-privileged users could harvest secrets/PII, profile schemas, and support lateral movement. Heavy logging can also raise costs and impact availability under load.

Recommendation

Keep log_min_duration_statement at -1 in production to avoid writing sensitive query text to logs. Apply least privilege to log access, enforce data minimization with redaction and short retention. If troubleshooting is required, enable narrowly and temporarily, prefer non-prod, and monitor access.

Remediation

CLI
Terraform
Dashboard steps

gcloud sql instances patch <example_resource_id> --database-flags=log_min_duration_statement=-1

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_id>"
  region           = "<region>"
  database_version = "POSTGRES_14"

  settings {
    tier = "<tier>"
    # Critical: set to -1 to pass the check
    database_flags {
      name  = "log_min_duration_statement"  # Critical
      value = "-1"                          # Critical
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_postgres_log_min_duration_statement_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL PostgreSQL: log_error_verbosity = default Cloud SQL PostgreSQL: log_min_error_statement = error

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires