Control: Ensure that the 'Log_min_messages' Flag for a Cloud SQL PostgreSQL Instance is set at minimum to 'Warning'

Description

The log_min_messages flag defines the minimum message severity level that is considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include DEBUG5, DEBUG4, DEBUG3, DEBUG2, DEBUG1, INFO, NOTICE, WARNING, ERROR, LOG, FATAL, and PANIC. Each severity level includes the subsequent levels mentioned above.

Usage

Run the control in your terminal:

powerpipe control run gcp_compliance.control.sql_instance_postgresql_log_min_messages_database_flag_error

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run gcp_compliance.control.sql_instance_postgresql_log_min_messages_database_flag_error --share

SQL

This control uses a named query:

select
  self_link as resource,
  case
    when database_version not like 'POSTGRES%' then 'skip'
    when database_flags is null or not (database_flags @> '[{"name":"log_min_messages"}]') then 'alarm'
    when database_flags @> '[{"name":"log_min_messages","value":"error"}]' or database_flags @> '[{"name":"log_min_messages","value":"warning"}]' then 'ok'
    else 'alarm'
  end as status,
  case
    when database_version not like 'POSTGRES%' then title || ' not a PostgreSQL database.'
    when database_flags is null or not (database_flags @> '[{"name":"log_min_messages"}]') then title || ' log_min_messages database flag not set.'
    when database_flags @> '[{"name":"log_min_messages","value":"error"}]' then title || ' log_min_messages database flag set to ERROR.'
    when database_flags @> '[{"name":"log_min_messages","value":"warning"}]' then title || ' log_min_messages database flag set to WARNING.'
    else title || ' log_min_messages database flag not set at minimum to WARNING.'
  end as reason
  
  , location as location, project as project
from
  gcp_sql_database_instance;

Control: Ensure that the 'Log_min_messages' Flag for a Cloud SQL PostgreSQL Instance is set at minimum to 'Warning'

Description

Usage

SQL

Tags