Back to Checks
gcp

Cloud SQL PostgreSQL instance has the log_min_duration_statement flag set to -1

cloudsql_instance_postgres_log_min_duration_statement_flag
Service: cloudsqlSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL for PostgreSQL evaluates whether log_min_duration_statement is set to -1, disabling statement duration logging.

Prowler logoProwlerprowler-provider-gcp

Risk

When duration-based statement logging is enabled, logs can capture full SQL with literals, exposing confidential data in log stores. Adversaries or over-privileged users could harvest secrets/PII, profile schemas, and support lateral movement. Heavy logging can also raise costs and impact availability under load.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_postgres_log_min_duration_statement_flag

Recommendation

Keep log_min_duration_statement at -1 in production to avoid writing sensitive query text to logs. Apply least privilege to log access, enforce data minimization with redaction and short retention. If troubleshooting is required, enable narrowly and temporarily, prefer non-prod, and monitor access.

Remediation

CLI

gcloud sql instances patch <example_resource_id> --database-flags=log_min_duration_statement=-1

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_id>"
  region           = "<region>"
  database_version = "POSTGRES_14"

  settings {
    tier = "<tier>"
    # Critical: set to -1 to pass the check
    database_flags {
      name  = "log_min_duration_statement"  # Critical
      value = "-1"                          # Critical
    }
  }
}

Other

1In Google Cloud Console, go to SQL > Instances
2Select your PostgreSQL instance
3Click Edit
4In Database flags, add or edit log_min_duration_statement and set it to -1
5Click Save (the instance may restart)

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_postgres_log_min_duration_statement_flag(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in cloudsql_client.instances:
            if "POSTGRES" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "PASS"
                report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_min_duration_statement' flag set to '-1'."
                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "log_min_duration_statement"
                        and flag.get("value", "-1") != "-1"
                    ):
                        report.status = "FAIL"
                        report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_min_duration_statement' flag set to '-1'."
                        break
                findings.append(report)

        return findings

References