Cloud SQL PostgreSQL instances should each have 'cloudsql.enable_pgaudit' set to 'on' for centralized logging
This control evaluates each Cloud SQL PostgreSQL instance for the `cloudsql.enable_pgaudit` database flag. The expected configuration is for every Cloud SQL PostgreSQL instance to have `cloudsql.enable_pgaudit` set to `on` for centralized logging.
Without cloudsql.enable_pgaudit, database activity lacks granular audit trails. Undetected reads/writes enable insider abuse, credential reuse, or SQL injection without evidence, harming confidentiality and integrity. Poor traceability slows incident response, forensics, and undermines compliance.
What this control checks
Checks the cloudsql.enable_pgaudit database flag on Cloud SQL PostgreSQL instances
Common pitfalls
KICS flags instances lacking settings or flags blocks
KICS flags a Postgres instance with no settings block. KICS also flags an instance with no database_flags.
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudsql_instance_postgres_enable_pgaudit_flag (prowler gcp --checks cloudsql_instance_postgres_enable_pgaudit_flag); PowerPipe control gcp_compliance.control.sql_instance_postgresql_cloudsql_pgaudit_database_flag_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_110; KICS query "Beta - SQL DB Instance Without Centralized Logging" (245eb024-d08a-449b-a1f2-02f7bba00fc2).
Framework-specific interpretation
PCI DSS v4.0: Mapped to 10.2.2 (Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of...).
NIST Cybersecurity Framework v2.0: Mapped to GV.SC-07 (The risks posed by a supplier, their products and services, and other third parties are understood, recorded...), ID.IM-01 (Improvements are identified from evaluations.), ID.IM-02 (Improvements are identified from security tests and exercises, including those done in coordination with suppliers and...) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
NIST Cybersecurity Framework v2.0
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- ID.IM-01: Improvements are identified from evaluations.
- ID.IM-02
- ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities.
- PR.DS-01
- 6.2.8 Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging
- 6.2.8 Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging
- 6.2.9 Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging
- 6.2.8 Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging
Related controls
- Cloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'
- Cloud SQL PostgreSQL instances should have 'log_executor_stats' set to 'off'
- Cloud SQL SQL Server instances should have 'user connections' configured
- Cloud SQL instances should not have public IP addresses
- Cloud SQL SQL Server instances should have 'external scripts enabled' set to 'off'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_postgresql_cloudsql_pgaudit_database_flag_enabled - Checkov Check:
CKV_GCP_110 - Powerpipe Control:
gcp_compliance.control.sql_instance_postgresql_cloudsql_pgaudit_database_flag_enabled - Prowler Check:
cloudsql_instance_postgres_enable_pgaudit_flag - KICS Query:
245eb024-d08a-449b-a1f2-02f7bba00fc2
Last reviewed: 2026-10-10