Cloud SQL PostgreSQL: log_min_error_statement = error

Check ID: cloudsql_instance_postgres_log_min_error_statement_flag
Provider: GCP
Service: cloudsql
Severity: MEDIUM
Categories: logging
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL for PostgreSQL uses the log_min_error_statement flag and expects it set to error, the severity threshold that controls when SQL text is logged with error messages.

Risk

An incorrect threshold skews visibility and exposure:

Lower than error: logs excessive SQL, risking confidentiality loss and alert noise (monitoring availability).
Higher than error: omits query context for real errors, weakening audit trail integrity and incident response.

Recommendation

Set log_min_error_statement to error to balance insight and exposure. Enforce a logging policy that limits sensitive data in queries and supports defense in depth. Periodically review severity and retention to match workload and compliance needs and maintain reliable forensic readiness.

Remediation

CLI
Terraform
Dashboard steps

gcloud sql instances patch <example_resource_name> --database-flags=log_min_error_statement=error

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  database_version = "POSTGRES_14"
  region           = "us-central1"

  settings {
    tier = "db-custom-2-7680"
    database_flags {
      name  = "log_min_error_statement"  # critical: requires minimum 'error' level
      value = "error"                     # sets the flag to pass the check
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_postgres_log_min_error_statement_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL PostgreSQL: log_min_duration_statement = -1 Cloud SQL PostgreSQL: log_min_messages = WARNING or higher

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires