Back to Checks
gcp

Cloud SQL PostgreSQL instance has the log_min_messages flag set to WARNING or higher

cloudsql_instance_postgres_log_min_messages_flag
Service: cloudsqlSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL for PostgreSQL instances are evaluated for the log_min_messages flag being set to a sufficiently high severity. Instances with the flag missing or set below ERROR (e.g., DEBUG*, INFO, NOTICE) are identified.

Prowler logoProwlerprowler-provider-gcp

Risk

Insufficient log_min_messages severity degrades audit log integrity, causing real failures to be treated as non-errors or lack context. This delays detection and impairs forensics, enabling unnoticed data tampering or repeated faulty operations, impacting the integrity and availability of the service.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_postgres_log_min_messages_flag

Recommendation

Set log_min_messages to ERROR or stricter to ensure error statements are captured with context. Align with centralized logging, retention, and review processes. Prefer defense in depth by preserving actionable error telemetry, while balancing verbosity and cost per your logging policy.

Remediation

CLI

gcloud sql instances patch <example_resource_name> --database-flags=log_min_messages=warning

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<example_region>"
  database_version = "POSTGRES_14"

  settings {
    tier = "db-f1-micro"

    # Critical: sets the minimum PostgreSQL log level to WARNING (or higher) to pass the check
    database_flags {
      name  = "log_min_messages"  # sets the flag
      value = "warning"            # acceptable level (WARNING or higher)
    }
  }
}

Other

1In Google Cloud Console, go to SQL and select your PostgreSQL instance
2Click Edit
3In Database flags, click Add item
4Choose log_min_messages and set value to warning
5Click Save and confirm the restart

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_postgres_log_min_messages_flag(Check):
    def execute(self) -> Check_Report_GCP:
        failing_log_levels = [
            "DEBUG5",
            "DEBUG4",
            "DEBUG3",
            "DEBUG2",
            "DEBUG1",
            "INFO",
            "NOTICE",
        ]

        findings = []
        for instance in cloudsql_client.instances:
            if "POSTGRES" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "FAIL"
                report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_min_messages' flag set."

                for flag in instance.flags:
                    if flag.get("name", "") == "log_min_messages":
                        current_level = flag.get("value", "").upper()
                        if current_level in failing_log_levels:
                            report.status = "FAIL"
                            report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_min_messages' flag set to '{current_level}', which is below the recommended minimum of 'ERROR'."
                        else:
                            report.status = "PASS"
                            report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_min_messages' flag set to an acceptable severity level: '{current_level}'."
                findings.append(report)

        return findings

References