SQL statements of GCP PostgreSQL are not logged misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_111
Category - Subcategory	Logging - Disabled or missing
Provider	GCP
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule (APPSEC_GCP_111) pertains to logging practices in Google Cloud Platform's (GCP) PostgreSQL. It ensures that SQL statements are being logged. Logging SQL statements is beneficial because it helps tracks all the actions and queries performed on a database server. From a security viewpoint, logging SQL statements is critical to detect and investigate suspicious database activity, reduce risk of data loss, and gather forensic evidence in case of a data breach. If SQL statements are not logged, an organization may miss crucial data and alerts about potential security threats or operational issues.

How to Fix

Resource: google_sql_database_instance

To fix this issue, you should enable the SQL logging for your GCP PostgreSQL database. Modify your google_sql_database_instance resource in the following way:

The above code is secure because it sets the log_statement flag to all in the google_sql_database_instance settings, which means that all SQL statements sent to the server will be logged – a good tool for troubleshooting and auditing. It is inline with Google Cloud's best practices for secure and dependable applications. [source,go]

resource "google_sql_database_instance" "default" { name = "database" region = "us-central1" database_version = "POSTGRES_11"

settings { ...

database_flags { name = "log_statement" value = "all" }

... } }