AlloyDB instances should have 'log_min_error_statement' set to 'Error' or stricter
The log_min_error_statement flag defines the minimum message severity level that are considered as an error statement. Messages for error statements are logged with the SQL statement. Ensure a value of ERROR or stricter is set.
The log_min_error_statement flag defines the minimum message severity level that are considered as an error statement. Messages for error statements are logged with the SQL statement.
What this control checks
Fails when log_min_error_statement is not set on an AlloyDB instance
Common pitfalls
Set log_min_error_statement to ERROR or stricter
Ensure a value of ERROR or stricter is set.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.alloydb_instance_log_min_error_statement_database_flag_configured.
Framework-specific interpretation
SOC 2: Mapped to CC7.2 (The entity monitors system components and the operation of those components for anomalies that are indicative of...).
NIST SP 800-53 Rev 5: Mapped to AU-12 (Audit Record Generation), AU-3 (Content of Audit Records) and AU-7 (Audit Record Reduction And Report Generation).
Framework mappings
The clauses this control is mapped to in each framework.
- CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
- AU-3 Content of Audit Records
- AU-7 Audit Record Reduction And Report Generation
- AU-12 Audit Record Generation
NIST Cybersecurity Framework v1.0
- DE.AE-3: Event data are collected and correlated from multiple sources and sensors.
- DE.CM-1: The network is monitored to detect potential cybersecurity events.
Related controls
- Cloud SQL PostgreSQL instances should have 'log_lock_waits' set to 'on'
- Cloud SQL PostgreSQL instances should have 'log_statement_stats' set to 'off'
- Projects should have log sinks configured for all log entries
- VPC networks should all have Cloud DNS logging enabled
- GCP projects should have Data Access audit logs enabled for Cloud Storage
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
alloydb_instance_log_min_error_statement_database_flag_configured - Powerpipe Control:
gcp_compliance.control.alloydb_instance_log_min_error_statement_database_flag_configured
Last reviewed: 2026-10-09