Cloud SQL PostgreSQL instances should have 'log_duration' set to 'on'
Validates that the `log_duration` setting is on, which causes the duration of each completed statement to be logged. Unlike the `log_min_duration_statement` flag, this setting does not log the text of the query itself.
Enabling the log_duration setting causes the duration of each completed statement to be logged.
What this control checks
Cloud SQL PostgreSQL instances must have the log_duration database flag set to on.
Common pitfalls
Does not log the text of the query
This does not logs the text of the query and thus behaves different from the log_min_duration_statement flag.
Parameter cannot be changed after session start
This parameter cannot be changed after session start.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.sql_instance_postgresql_log_duration_database_flag_on.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_GCP_13.
Framework-specific interpretation
CIS GCP Benchmark v1.2.0: Mapped to 6.2.5 (Ensure 'log_duration' database flag for Cloud SQL PostgreSQL instance is set to 'on').
Framework mappings
The clauses this control is mapped to in each framework.
- 6.2.5 Ensure 'log_duration' database flag for Cloud SQL PostgreSQL instance is set to 'on'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_postgresql_log_duration_database_flag_on - Checkov Check:
CKV2_GCP_13 - Powerpipe Control:
gcp_compliance.control.sql_instance_postgresql_log_duration_database_flag_on
Last reviewed: 2026-10-10