Policy: GCP > CIS v4.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.04 - Ensure 'Log_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set Appropriately

Configures auditing against a CIS Benchmark item.

Level: 2

The value of log_statement flag determined the SQL statements that are logged. Valid values are:

- none - ddl - mod - all

The value ddl logs all data definition statements. The value mod logs all ddl statements, plus data-modifying statements.

The statements are logged after a basic parsing is done and statement type is determined, thus this does not logs statements with errors. When using extended query protocol, logging occurs after an Execute message is received and values of the Bind parameters are included.

A value of 'ddl' is recommended unless otherwise directed by your organization's logging policy.

Targets

This policy targets the following resource types:

GCP > SQL > Instance

Primary Policy

This policy is used with the following primary policy:

GCP > CIS v4.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database

Controls

Setting this policy configures this control:

GCP > CIS v4.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.04 - Ensure 'Log_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set Appropriately

Policy Specification

Schema Type	`string`
Default	`Per GCP > CIS v4.0 > 6 - Cloud SQL Database Services`
Valid Values [YAML]	`Per GCP > CIS v4.0 > 6 - Cloud SQL Database Services` `Skip` `Check: Benchmark`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/cis#/control/categories/v070603

Policy Type URI

tmod:@turbot/gcp-cisv4-0#/policy/types/r060204

GraphQL

query policyType(id: "tmod:@turbot/gcp-cisv4-0#/policy/types/r060204") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/gcp-cisv4-0#/policy/types/r060204'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/gcp-cisv4-0#/policy/types/r060204'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/gcp-cisv4-0#/policy/types/r060204"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/gcp-cisv4-0#/policy/types/r060204"