Back to Checks
gcp

Cloud SQL for PostgreSQL instance has log_min_error_statement set to error

cloudsql_instance_postgres_log_min_error_statement_flag
Service: cloudsqlSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL for PostgreSQL uses the log_min_error_statement flag and expects it set to error, the severity threshold that controls when SQL text is logged with error messages.

Prowler logoProwlerprowler-provider-gcp

Risk

An incorrect threshold skews visibility and exposure:

  • Lower than error: logs excessive SQL, risking confidentiality loss and alert noise (monitoring availability).
  • Higher than error: omits query context for real errors, weakening audit trail integrity and incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_postgres_log_min_error_statement_flag

Recommendation

Set log_min_error_statement to error to balance insight and exposure. Enforce a logging policy that limits sensitive data in queries and supports defense in depth. Periodically review severity and retention to match workload and compliance needs and maintain reliable forensic readiness.

Remediation

CLI

gcloud sql instances patch <example_resource_name> --database-flags=log_min_error_statement=error

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  database_version = "POSTGRES_14"
  region           = "us-central1"

  settings {
    tier = "db-custom-2-7680"
    database_flags {
      name  = "log_min_error_statement"  # critical: requires minimum 'error' level
      value = "error"                     # sets the flag to pass the check
    }
  }
}

Other

1In Google Cloud Console, go to Cloud SQL > Instances and open your PostgreSQL instance
2Click Edit
3In Database flags, click Add item, select log_min_error_statement, set value to error
4Click Save (the instance will restart)

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_postgres_log_min_error_statement_flag(Check):
    def execute(self) -> Check_Report_GCP:
        desired_log_min_error_statement = "error"
        findings = []
        for instance in cloudsql_client.instances:
            if "POSTGRES" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "PASS"
                report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_min_error_statement' flag set minimum to '{desired_log_min_error_statement}'."

                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "log_min_error_statement"
                        and flag.get("value", "error")
                        != desired_log_min_error_statement
                    ):
                        report.status = "FAIL"
                        report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_min_error_statement' flag set minimum to '{desired_log_min_error_statement}'."
                        break
                findings.append(report)

        return findings

References