GCP PostgreSQL instance database flag log_min_messages is not set misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_55
Category - Subcategory	Logging - Disabled or missing
Provider	GCP
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	34b9685e-8fc8-4504-b7fb-037b7733a2b0

Impact

The log_min_error_statement database flag defines the minimum message severity level that is considered to be an error statement. Messages for error statements are logged with the SQL statement. Valid values include: DEBUG5, DEBUG4, DEBUG3, DEBUG2, DEBUG1, INFO, NOTICE, WARNING, ERROR, LOG, FATAL, and PANIC. Each severity level includes subsequent levels. Deadlock timeout defines the time to wait on a lock before checking for any conditions. Frequent runovers on deadlock timeout can be an indication of an underlying issue. Log these waits on locks using the log_lock_waits database flag and use the information to identify poor performance due to locking delays, or if a specially-crafted SQL is attempting to starve resources through holding locks for excessive amounts of time. We recommend you set the log_min_error_statement flag for PostgreSQL database instances in accordance with your organization's logging policy for auditing purposes. Auditing helps you troubleshoot operational problems, and also permits forensic analysis. If log_min_error_statement is not set to the correct value, messages may not be classified as error messages appropriately. Considering general log messages as error messages would make it difficult to find actual errors, while considering only stricter severity levels as error messages may skip actual errors to log their SQL statements.

NOTE: To effectively turn off logging failing statements, set this parameter to PANIC. ERROR is considered the best practice setting. Changes should only be made in accordance with the organization's logging policy.

How to Fix

Resource: google_sql_database_instance

• Arguments: database_version = "POSTGRES_* " settings::database_flags: key:"log_min_messages", value: by default set to "ERROR" Argument value can be one of the following: DEBUG5, DEBUG4, DEBUG3, DEBUG2, DEBUG1, INFO, NOTICE, WARNING, ERROR, LOG, FATAL, and PANIC [source,go]

---

resource "google_sql_database_instance" "default" { name = "master-instance" database_version = "POSTGRES_11" region = "us-central1"

settings {

• database_flags {
• name = "log_min_messages"
• value = "DEBUG5" } } }

---