Cloud SQL PostgreSQL: log_min_messages = WARNING or higher

Check ID: cloudsql_instance_postgres_log_min_messages_flag
Provider: GCP
Service: cloudsql
Severity: MEDIUM
Categories: logging
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL for PostgreSQL instances are evaluated for the log_min_messages flag being set to a sufficiently high severity. Instances with the flag missing or set below ERROR (e.g., DEBUG*, INFO, NOTICE) are identified.

Risk

Insufficient log_min_messages severity degrades audit log integrity, causing real failures to be treated as non-errors or lack context. This delays detection and impairs forensics, enabling unnoticed data tampering or repeated faulty operations, impacting the integrity and availability of the service.

Recommendation

Set log_min_messages to ERROR or stricter to ensure error statements are captured with context. Align with centralized logging, retention, and review processes. Prefer defense in depth by preserving actionable error telemetry, while balancing verbosity and cost per your logging policy.

Remediation

CLI
Terraform
Dashboard steps

gcloud sql instances patch <example_resource_name> --database-flags=log_min_messages=warning

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<example_region>"
  database_version = "POSTGRES_14"

  settings {
    tier = "db-f1-micro"

    # Critical: sets the minimum PostgreSQL log level to WARNING (or higher) to pass the check
    database_flags {
      name  = "log_min_messages"  # sets the flag
      value = "warning"            # acceptable level (WARNING or higher)
    }
  }
}

References

https://cloud.google.com/sql/docs/postgres/flags

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_postgres_log_min_messages_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL PostgreSQL: log_min_error_statement = error Cloud SQL PostgreSQL: log_statement = ddl

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires