Back to Checks
gcp

Cloud SQL PostgreSQL instance has log_connections flag set to on

cloudsql_instance_postgres_log_connections_flag
Service: cloudsqlSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL for PostgreSQL instances have the log_connections flag set to on, causing the server to record every connection attempt and the result of client authentication.

Prowler logoProwlerprowler-provider-gcp

Risk

Without connection logs, unauthorized access attempts can go unnoticed. Attackers may brute-force or reuse credentials without audit evidence, enabling stealthy data access (confidentiality), changes via compromised accounts (integrity), and connection floods that impact service (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_postgres_log_connections_flag

Recommendation

Enable log_connections=on for all PostgreSQL instances.

  • Apply defense in depth: also capture disconnects and audit events
  • Centralize logs, retain them, and alert on anomalies
  • Enforce least privilege and strong authentication to reduce exposure and improve detection

Remediation

CLI

gcloud sql instances patch <INSTANCE_NAME> --database-flags=log_connections=on

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  database_version = "POSTGRES_14"
  region           = "<region>"

  settings {
    tier = "db-f1-micro"

    # Critical: enables connection logging to pass the check
    database_flags {
      name  = "log_connections"  # critical
      value = "on"                # critical
    }
  }
}

Other

1In Google Cloud Console, go to Cloud SQL > Instances
2Open your PostgreSQL instance and click Edit
3In Flags, click Add item, select log_connections, set value to on
4Click Save and confirm the restart

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_postgres_log_connections_flag(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            if "POSTGRES" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "FAIL"
                report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_connections' flag set to 'on'."
                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "log_connections"
                        and flag.get("value", "off") == "on"
                    ):
                        report.status = "PASS"
                        report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_connections' flag set to 'on'."
                        break
                findings.append(report)

        return findings

References