Back to Checks
gcp

Cloud SQL PostgreSQL instance has log_disconnections flag set to on

cloudsql_instance_postgres_log_disconnections_flag
Service: cloudsqlSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL for PostgreSQL instances have the log_disconnections flag set to on, creating a record each time a client session ends, including its duration and status

Prowler logoProwlerprowler-provider-gcp

Risk

Without disconnection logs, session lifecycles lack visibility, obscuring credential misuse, session hijacking, and short-lived data exfiltration.

Weak audit trails hinder correlation and forensics, undermining confidentiality and integrity and slowing incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_postgres_log_disconnections_flag

Recommendation

Enable log_disconnections=on to ensure complete session auditing.

  • Pair with log_connections and a consistent log_line_prefix
  • Centralize and retain logs; alert on anomalies
  • Apply defense in depth with routine review of access and audit events

Remediation

CLI

gcloud sql instances patch <example_resource_name> --database-flags=log_disconnections=on

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<REGION>"
  database_version = "POSTGRES_14"

  settings {
    tier = "<TIER>"

    # Critical: enable disconnect logging
    database_flags {
      name  = "log_disconnections"  # sets the required flag
      value = "on"                   # ensures the check passes
    }
  }
}

Other

1In Google Cloud Console, go to Cloud SQL > Instances
2Click your PostgreSQL instance
3Click Edit
4In Database flags, click Add item
5Select log_disconnections and set value to on
6Click Save and confirm the restart

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_postgres_log_disconnections_flag(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            if "POSTGRES" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "FAIL"
                report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_disconnections' flag set to 'on'."
                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "log_disconnections"
                        and flag.get("value", "off") == "on"
                    ):
                        report.status = "PASS"
                        report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_disconnections' flag set to 'on'."
                        break
                findings.append(report)

        return findings

References