Ensure that the 'Log_min_messages' Flag for a Cloud SQL PostgreSQL Instance is set at minimum to 'Warning'

Risk Level: Low
Cloud Entity: GCP CloudSql
CloudGuard Rule ID: D9.GCP.LOG.16
Covered by Spectral: Yes
Category: Database

GSL LOGIC

CloudSql where databaseVersion like 'POSTGRES%' should have settings.databaseFlags contain [ name like 'log_min_messages' and value in('warning','error','log','fatal','panic')]

REMEDIATION

From Portal

1. Go to https://console.cloud.google.com/sql/instances and navigate to the instance where the flag needs to be set
2. Click Edit Configurations
3. Scroll down to the Flags section.
4. To set a flag that has not been set on the instance before, click Add item, choose the flag log_min_messages from the drop-down menu and set appropriate value.
5. Save and review your changes

From TF
Set the flag 'log_min_messages' with valid value:

resource 'google_sql_database_instance' 'default' {
	...
	settings {
		database_flags {
			name  = 'log_min_messages'
			value = 'debug5|debug4|debug3|debug2|debug1|info|notice|warning|error|log|fatal|panic'
		}
	}
}

From Command Line

1. First retrieve all existing flags values:

gcloud sql instances describe INSTANCE_NAME

2. Add all existing flags and their value to the patch request - otherwise they will get set to their default value.

gcloud sql instances patch INSTANCE_NAME --database-flags (ExistingFlag1=Value1,ExistingFlag2=Value2,...),log_min_messages=<'debug5|debug4|debug3|debug2|debug1|info|notice|warning|error|log|fatal|panic'>

References

1. https://cloud.google.com/sql/docs/postgres/flags
2. https://www.postgresql.org/docs/9.6/runtime-config-logging.html#RUNTIME-CONFIG-LOGGING-WHEN

GCP CloudSql

Cloud SQL is a fully managed database service that makes it easy to set up, maintain, manage, and administer your relational PostgreSQL, MySQL, and SQL Server databases in the cloud.

Compliance Frameworks

• CloudGuard GCP All Rules Ruleset
• GCP CIS Controls V 8
• GCP CIS Foundations v. 1.1.0
• GCP CIS Foundations v. 1.2.0
• GCP CIS Foundations v. 1.3.0
• GCP CIS Foundations v. 2.0
• GCP CloudGuard Best Practices
• GCP MITRE ATT&CK Framework v12.1
• GCP NIST 800-53 Rev 5