Control: GCP SQL PostgreSQL instance should have log_min_messages database flag set to a valid value

Description

This control checks whether the log_min_messages database flag for Cloud SQL PostgreSQL instance is set to a valid value.

Usage

Run the control in your terminal:

powerpipe control run terraform_gcp_compliance.control.sql_instance_postgresql_log_min_messages_flag_set

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_gcp_compliance.control.sql_instance_postgresql_log_min_messages_flag_set --share

SQL

This control uses a named query:

select
  address as resource,
  case
    when jsonb_typeof(attributes_std -> 'settings' -> 'database_flags') = 'object' and (attributes_std -> 'settings' -> 'database_flags' ->> 'name') = 'log_min_messages' and (attributes_std -> 'settings' -> 'database_flags' ->> 'value') in ('fatal', 'panic', 'log', 'error', 'warning', 'notice', 'info', 'debug1', 'debug2', 'debug3', 'debug4', 'debug5') then 'ok'
    when jsonb_typeof(attributes_std -> 'settings' -> 'database_flags') = 'array' and exists(select 1 from jsonb_array_elements(attributes_std -> 'settings' -> 'database_flags') as flags where (flags ->> 'name') = 'log_min_messages' and (flags ->> 'value') in ('fatal', 'panic', 'log', 'error', 'warning', 'notice', 'info', 'debug1', 'debug2', 'debug3', 'debug4', 'debug5')) then 'ok'
    else 'alarm'
  end as status,
  split_part(address, '.', 2) || case
    when jsonb_typeof(attributes_std -> 'settings' -> 'database_flags') = 'object' and (attributes_std -> 'settings' -> 'database_flags' ->> 'name') = 'log_min_messages' and (attributes_std -> 'settings' -> 'database_flags' ->> 'value') in ('fatal', 'panic', 'log', 'error', 'warning', 'notice', 'info', 'debug1', 'debug2', 'debug3', 'debug4', 'debug5') then ' log min messages database flag value set to fatal, panic, log, error, warning, notice, info, debug1, debug2, debug3, debug4, debug5'
    when jsonb_typeof(attributes_std -> 'settings' -> 'database_flags') = 'array' and exists(select 1 from jsonb_array_elements(attributes_std -> 'settings' -> 'database_flags') as flags where (flags ->> 'name') = 'log_min_messages' and (flags ->> 'value') in ('fatal', 'panic', 'log', 'error', 'warning', 'notice', 'info', 'debug1', 'debug2', 'debug3', 'debug4', 'debug5')) then ' log min messages database flag value set to fatal, panic, log, error, warning, notice, info, debug1, debug2, debug3, debug4, debug5'
    else ' log min messages database flag value not set'
  end || '.' reason
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'google_sql_database_instance'
  and (attributes_std ->> 'database_version') like 'POSTGRES%';

Control: GCP SQL PostgreSQL instance should have log_min_messages database flag set to a valid value

Description

Usage

SQL

Tags