Google Cloud Compliance ControlsGoogle Cloud SQL
Cloud SQL PostgreSQL instances should have 'log_checkpoints' set to 'on'
Ensure that the log_checkpoints database flag for the Cloud SQL PostgreSQL instance is set to on. Trivy GCP-0025 states: Ensure that logging of checkpoints is enabled. Logging checkpoints provides useful diagnostic data.
What this control checks
Cloud SQL PostgreSQL log_checkpoints database flag must be set to on
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- 6.2.1 Ensure that the 'log_checkpoints' database flag for Cloud SQL PostgreSQL instance is set to 'on'
Related controls
- Cloud SQL PostgreSQL instances should have 'log_executor_stats' set to 'off'
- Cloud SQL PostgreSQL instances should have 'log_parser_stats' set to 'off'
- Cloud SQL PostgreSQL instances should have 'log_hostname' configured appropriately
- Cloud SQL PostgreSQL instances should each have 'cloudsql.enable_pgaudit' set to 'on' for centralized logging
- Cloud SQL MySQL instances should have 'local_infile' set to 'off'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_postgresql_log_checkpoints_database_flag_on - Checkov Check:
CKV_GCP_51 - Powerpipe Control:
gcp_compliance.control.sql_instance_postgresql_log_checkpoints_database_flag_on - Trivy Check:
GCP-0025
Last reviewed: 2026-10-10