Ensure 'log_statement_stats' database flag for Cloud SQL PostgreSQL instance is set to 'off'

The 'log_statement_stats' flag controls the inclusion of end to end performance statistics of a SQL query in the PostgreSQL logs for each query. This cannot be enabled with other module statistics ('log_parser_stats', 'log_planner_stats', 'log_executor_stats').

Risk Level: Low
Cloud Entity: GCP CloudSql
CloudGuard Rule ID: D9.GCP.LOG.11
Covered by Spectral: Yes
Category: Database

GSL LOGIC

CloudSql where databaseVersion like 'POSTGRES%' should have settings.databaseFlags contain [ name like 'log_statement_stats' and value like 'off' ]

REMEDIATION

From Portal

  1. Go to https://console.cloud.google.com/sql/instances and navigate to the instance where the flag needs to be set
  2. Click Edit Configurations
  3. Under flags section, choose add flag, look for log_statement_stats and choose value - off.
  4. Save and review your changes

From TF
Set the flag 'log_statement_stats' to 'off':

resource 'google_sql_database_instance' 'default' {
	...
	settings {
		database_flags {
			name  = 'log_statement_stats'
			value = 'off'
		}
	}
}

From Command Line

  1. First retrieve all existing flags values:
gcloud sql instances describe INSTANCE_NAME
  1. Add all existing flags and their value to the patch request - otherwise they will get set to their default value.
gcloud sql instances patch INSTANCE_NAME --database-flags (ExistingFlag1=Value1,ExistingFlag2=Value2,...),log_statement_stats=off

References

  1. https://www.postgresql.org/docs/9.6/runtime-config-statistics.html#RUNTIME-CONFIG-STATISTICS-MONITOR
  2. https://cloud.google.com/sql/docs/postgres/flags

GCP CloudSql

Cloud SQL is a fully managed database service that makes it easy to set up, maintain, manage, and administer your relational PostgreSQL, MySQL, and SQL Server databases in the cloud.

Compliance Frameworks

  • CloudGuard GCP All Rules Ruleset
  • GCP CIS Foundations v. 1.2.0
  • GCP CloudGuard Best Practices
  • GCP MITRE ATT&CK Framework v12.1
  • GCP NIST 800-53 Rev 5