Cloud SQL PostgreSQL instances should have 'log_checkpoints' set to 'on'
Ensure that the log_checkpoints database flag for the Cloud SQL PostgreSQL instance is set to on. Trivy GCP-0025 states: Ensure that logging of checkpoints is enabled. Logging checkpoints provides useful diagnostic data.
Logging checkpoints provides useful diagnostic data, which can identify performance issues in an application and potential DoS vectors.
What this control checks
Cloud SQL PostgreSQL log_checkpoints database flag must be set to on
Common pitfalls
Flag must be explicitly set
Checkov CKV_GCP_51 returns FAILED when the flag is not explicitly set. The check passes only when database_flags has name log_checkpoints with value on.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.sql_instance_postgresql_log_checkpoints_database_flag_on.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_51; Trivy check GCP-0025.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to GV.SC-07 (The risks posed by a supplier, their products and services, and other third parties are understood, recorded...).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- 6.2.1 Ensure that the 'log_checkpoints' database flag for Cloud SQL PostgreSQL instance is set to 'on'
Related controls
- Cloud SQL PostgreSQL instances should have 'log_executor_stats' set to 'off'
- Cloud SQL PostgreSQL instances should have 'log_parser_stats' set to 'off'
- Cloud SQL PostgreSQL instances should have 'log_hostname' configured appropriately
- Cloud SQL PostgreSQL instances should each have 'cloudsql.enable_pgaudit' set to 'on' for centralized logging
- Cloud SQL MySQL instances should have 'local_infile' set to 'off'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_postgresql_log_checkpoints_database_flag_on - Checkov Check:
CKV_GCP_51 - Powerpipe Control:
gcp_compliance.control.sql_instance_postgresql_log_checkpoints_database_flag_on - Trivy Check:
GCP-0025
Last reviewed: 2026-10-10