Google Cloud Compliance ControlsGoogle Cloud SQL
Cloud SQL PostgreSQL instances should each have 'cloudsql.enable_pgaudit' set to 'on' for centralized logging
This control evaluates each Cloud SQL PostgreSQL instance for the `cloudsql.enable_pgaudit` database flag. The expected configuration is for every Cloud SQL PostgreSQL instance to have `cloudsql.enable_pgaudit` set to `on` for centralized logging.
What this control checks
Checks the cloudsql.enable_pgaudit database flag on Cloud SQL PostgreSQL instances
Framework mappings
The clauses this control is mapped to in each framework.
- 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
NIST Cybersecurity Framework v2.0
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- ID.IM-01: Improvements are identified from evaluations.
- ID.IM-02
- ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities.
- PR.DS-01
- 6.2.8 Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging
- 6.2.8 Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging
- 6.2.9 Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging
- 6.2.8 Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging
Related controls
- Cloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'
- Cloud SQL PostgreSQL instances should have 'log_executor_stats' set to 'off'
- Cloud SQL SQL Server instances should have 'user connections' configured
- Cloud SQL instances should not have public IP addresses
- Cloud SQL SQL Server instances should have 'external scripts enabled' set to 'off'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_postgresql_cloudsql_pgaudit_database_flag_enabled - Checkov Check:
CKV_GCP_110 - Powerpipe Control:
gcp_compliance.control.sql_instance_postgresql_cloudsql_pgaudit_database_flag_enabled - Prowler Check:
cloudsql_instance_postgres_enable_pgaudit_flag - KICS Query:
245eb024-d08a-449b-a1f2-02f7bba00fc2
Last reviewed: 2026-10-10