Back to Checks
gcp

Cloud SQL PostgreSQL instance has 'log_statement' flag set to 'ddl'

cloudsql_instance_postgres_log_statement_flag
Service: cloudsqlSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:sqladmin.googleapis.com/Instance

Cloud SQL for PostgreSQL instances have log_statement set to ddl, recording only data definition statements in server logs

Prowler logoProwlerprowler-provider-gcp

Risk

Missing ddl logging leaves schema changes untracked, undermining integrity and hindering investigations.

Excessive logging (e.g., all) can inflate volumes, impair availability, raise costs, and leak sensitive values, harming confidentiality.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudsql_instance_postgres_log_statement_flag

Recommendation

Configure log_statement to ddl to capture schema changes without excessive noise. Apply defense in depth: use targeted auditing for data access, restrict and monitor log access with least privilege, and enforce log retention and rotation to protect availability.

Remediation

CLI

gcloud sql instances patch <example_resource_name> --database-flags=log_statement=ddl

Terraform

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<region>"
  database_version = "POSTGRES_14"

  settings {
    tier = "db-custom-2-7680"

    # Critical: sets PostgreSQL 'log_statement' to 'ddl' to pass the check
    database_flags {
      name  = "log_statement"   # required flag name
      value = "ddl"             # required value
    }
  }
}

Other

1In Google Cloud Console, go to SQL > Instances and open <example_resource_name>
2Click Edit
3In Database flags, click Add item
4Select log_statement and set value to ddl
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client


class cloudsql_instance_postgres_log_statement_flag(Check):
    def execute(self) -> Check_Report_GCP:
        desired_log_statement = "ddl"
        findings = []
        for instance in cloudsql_client.instances:
            if "POSTGRES" in instance.version:
                report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
                report.status = "FAIL"
                report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_statement' flag set to '{desired_log_statement}'."
                for flag in instance.flags:
                    if (
                        flag.get("name", "") == "log_statement"
                        and flag.get("value", "none") == desired_log_statement
                    ):
                        report.status = "PASS"
                        report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_statement' flag set to '{desired_log_statement}'."
                        break
                findings.append(report)

        return findings

References