Control: Ensure that the 'log_connections' database flag for Cloud SQL PostgreSQL instance is set to 'on'

Description

Enabling the log_connections setting causes each attempted connection to the server to be logged, along with successful completion of client authentication. This parameter cannot be changed after the session starts.

Usage

Run the control in your terminal:

powerpipe control run gcp_compliance.control.sql_instance_postgresql_log_connections_database_flag_on

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run gcp_compliance.control.sql_instance_postgresql_log_connections_database_flag_on --share

SQL

This control uses a named query:

select
  self_link resource,
  case
    when database_version not like 'POSTGRES%' then 'skip'
    when database_flags @> '[{"name":"log_connections","value":"on"}]' then 'ok'
    else 'alarm'
  end as status,
  case
    when database_version not like 'POSTGRES%'
      then title || ' not a PostgreSQL database.'
    when database_flags is null or not (database_flags @> '[{"name":"log_connections"}]')
      then title || ' ''log_connections'' database flag not set.'
    when database_flags @> '[{"name":"log_connections","value":"on"}]'
      then title || ' ''log_connections'' database flag set to ''on''.'
    else title || ' ''log_connections'' database flag set to ''off''.'
  end as reason
    
    , location as location, project as project
from
  gcp_sql_database_instance;

Control: Ensure that the 'log_connections' database flag for Cloud SQL PostgreSQL instance is set to 'on'

Description

Usage

SQL

Tags