Google Cloud Compliance ControlsGoogle Cloud AlloyDB for PostgreSQL
AlloyDB instances should have 'log_min_error_statement' set to 'Error' or stricter
The log_min_error_statement flag defines the minimum message severity level that are considered as an error statement. Messages for error statements are logged with the SQL statement. Ensure a value of ERROR or stricter is set.
What this control checks
Fails when log_min_error_statement is not set on an AlloyDB instance
Framework mappings
The clauses this control is mapped to in each framework.
- CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
- AU-3 Content of Audit Records
- AU-7 Audit Record Reduction And Report Generation
- AU-12 Audit Record Generation
NIST Cybersecurity Framework v1.0
- DE.AE-3: Event data are collected and correlated from multiple sources and sensors.
- DE.CM-1: The network is monitored to detect potential cybersecurity events.
Related controls
- Cloud SQL PostgreSQL instances should have 'log_lock_waits' set to 'on'
- Cloud SQL PostgreSQL instances should have 'log_statement_stats' set to 'off'
- Projects should have log sinks configured for all log entries
- VPC networks should all have Cloud DNS logging enabled
- GCP projects should have Data Access audit logs enabled for Cloud Storage
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
alloydb_instance_log_min_error_statement_database_flag_configured - Powerpipe Control:
gcp_compliance.control.alloydb_instance_log_min_error_statement_database_flag_configured
Last reviewed: 2026-10-09