Back to Checks
gcp

Cloud SQL PostgreSQL instance has 'cloudsql.enable_pgaudit' flag set to 'on'

cloudsql_instance_postgres_enable_pgaudit_flag
Service: cloudsqlSeverity: high
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL for PostgreSQL instances are evaluated for the database flag cloudsql.enable_pgaudit being set to on

Prowler logoProwlerprowler-provider-gcp

Risk

Without cloudsql.enable_pgaudit, database activity lacks granular audit trails. Undetected reads/writes enable insider abuse, credential reuse, or SQL injection without evidence, harming confidentiality and integrity. Poor traceability slows incident response, forensics, and undermines compliance.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_postgres_enable_pgaudit_flag

Recommendation

Enable cloudsql.enable_pgaudit and configure pgAudit to log required classes (e.g., read, write, ddl) under least privilege. Centralize logs, enforce retention and RBAC, and monitor with alerts. Scope auditing to sensitive data to reduce noise and overhead, and review coverage regularly.

Remediation

CLI

gcloud sql instances patch <example_resource_id> --database-flags cloudsql.enable_pgaudit=on

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_id>"
  region           = "us-central1"
  database_version = "POSTGRES_14"

  settings {
    tier = "db-custom-1-3840"
    database_flags {
      name  = "cloudsql.enable_pgaudit"  # Critical: enable pgAudit
      value = "on"                        # Critical: set flag to 'on' to pass the check
    }
  }
}

Other

1In Google Cloud Console, go to SQL
2Select your PostgreSQL instance and click Edit
3In Database flags, click Add item
4Set Flag to cloudsql.enable_pgaudit and Value to on
5Click Save and restart if prompted

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_postgres_enable_pgaudit_flag(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            if "POSTGRES" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "FAIL"
                report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'cloudsql.enable_pgaudit' flag set to 'on'."
                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "cloudsql.enable_pgaudit"
                        and flag.get("value", "off") == "on"
                    ):
                        report.status = "PASS"
                        report.status_extended = f"PostgreSQL Instance {instance.name} has 'cloudsql.enable_pgaudit' flag set to 'on'."
                        break
                findings.append(report)

        return findings

References