Cloud SQL PostgreSQL: log_statement = ddl

Check ID: cloudsql_instance_postgres_log_statement_flag
Provider: GCP
Service: cloudsql
Severity: MEDIUM
Categories: logging
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL for PostgreSQL instances have log_statement set to ddl, recording only data definition statements in server logs

Risk

Missing ddl logging leaves schema changes untracked, undermining integrity and hindering investigations. Excessive logging (e.g., all) can inflate volumes, impair availability, raise costs, and leak sensitive values, harming confidentiality.

Recommendation

Configure log_statement to ddl to capture schema changes without excessive noise. Apply defense in depth: use targeted auditing for data access, restrict and monitor log access with least privilege, and enforce log retention and rotation to protect availability.

Remediation

CLI
Terraform
Dashboard steps

gcloud sql instances patch <example_resource_name> --database-flags=log_statement=ddl

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<region>"
  database_version = "POSTGRES_14"

  settings {
    tier = "db-custom-2-7680"

    # Critical: sets PostgreSQL 'log_statement' to 'ddl' to pass the check
    database_flags {
      name  = "log_statement"   # required flag name
      value = "ddl"             # required value
    }
  }
}

References

https://cloud.google.com/sql/docs/postgres/flags

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_postgres_log_statement_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL PostgreSQL: log_min_messages = WARNING or higher Cloud SQL instance has no public IP addresses

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires