Back to Checks
gcp

Cloud SQL PostgreSQL instance has log_error_verbosity flag set to default

cloudsql_instance_postgres_log_error_verbosity_flag
Service: cloudsqlSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL for PostgreSQL evaluates the log_error_verbosity database flag and expects the value default.

Configurations using terse or verbose are flagged as deviations.

Prowler logoProwlerprowler-provider-gcp

Risk

With verbose, logs may reveal SQLSTATE, code paths, and function details, aiding recon and leaking metadata (confidentiality). With terse, missing DETAIL/HINT/CONTEXT hinders detection and forensics, reducing integrity of investigations and availability of operational insight.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_postgres_log_error_verbosity_flag

Recommendation

Set log_error_verbosity to default to balance data minimization and observability.

  • Avoid verbose in production; restrict log access (least privilege)
  • Avoid terse except briefly to curb noise
  • Centralize logs with retention and tamper protection for defense in depth

Remediation

CLI

gcloud sql instances patch <INSTANCE_NAME> --database-flags=log_error_verbosity=default

Terraform

resource "google_sql_database_instance" "main" {
  name             = "<example_resource_name>"
  region           = "<example_region>"
  database_version = "POSTGRES_14"

  settings {
    tier = "<example_machine_tier>"

    database_flags {
      name  = "log_error_verbosity"
      value = "default" # Critical: sets the flag to default to pass the check
    }
  }
}

Other

1In Google Cloud Console, go to Cloud SQL > Instances
2Open the PostgreSQL instance
3Click Edit
4In Database flags, set log_error_verbosity to default (or remove the custom value)
5Click Save (the instance may restart)

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_postgres_log_error_verbosity_flag(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            if "POSTGRES" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "PASS"
                report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_error_verbosity' flag set to 'default'."
                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "log_error_verbosity"
                        and flag.get("value", "default") != "default"
                    ):
                        report.status = "FAIL"
                        report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_error_verbosity' flag set to 'default'."
                        break
                findings.append(report)

        return findings

References