Control: GCP SQL PostgreSQL instance should log SQL statements

Description

This control checks whether the log_statement database flag for Cloud SQL PostgreSQL instance is set to log SQL statements.

Usage

Run the control in your terminal:

powerpipe control run terraform_gcp_compliance.control.sql_instance_postgresql_log_statement_flag_set

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_gcp_compliance.control.sql_instance_postgresql_log_statement_flag_set --share

SQL

This control uses a named query:

select
  address as resource,
  case
    when jsonb_typeof(attributes_std -> 'settings' -> 'database_flags') = 'object' and (attributes_std -> 'settings' -> 'database_flags' ->> 'name') = 'log_statement' and (attributes_std -> 'settings' -> 'database_flags' ->> 'value') in ('ddl', 'mod', 'all') then 'ok'
    when jsonb_typeof(attributes_std -> 'settings' -> 'database_flags') = 'array' and exists(select 1 from jsonb_array_elements(attributes_std -> 'settings' -> 'database_flags') as flags where (flags ->> 'name') = 'log_statement' and (flags ->> 'value') in ('ddl', 'mod', 'all')) then 'ok'
    else 'alarm'
  end as status,
  split_part(address, '.', 2) || case
    when jsonb_typeof(attributes_std -> 'settings' -> 'database_flags') = 'object' and (attributes_std -> 'settings' -> 'database_flags' ->> 'name') = 'log_statement' and (attributes_std -> 'settings' -> 'database_flags' ->> 'value') in ('ddl', 'mod', 'all') then ' log min messages database flag value set to fatal, panic, log, error, warning, notice, info, debug1, debug2, debug3, debug4, debug5'
    when jsonb_typeof(attributes_std -> 'settings' -> 'database_flags') = 'array' and exists(select 1 from jsonb_array_elements(attributes_std -> 'settings' -> 'database_flags') as flags where (flags ->> 'name') = 'log_statement' and (flags ->> 'value') in ('ddl', 'mod', 'all')) then ' log min messages database flag value set to fatal, panic, log, error, warning, notice, info, debug1, debug2, debug3, debug4, debug5'
    else ' log min messages database flag value not set'
  end || '.' reason
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'google_sql_database_instance'
  and (attributes_std ->> 'database_version') like 'POSTGRES%';

Control: GCP SQL PostgreSQL instance should log SQL statements

Description

Usage

SQL

Tags