Cloud SQL PostgreSQL instances should have 'log_hostname' configured appropriately
This control looks at the `log_hostname` flag on Cloud SQL PostgreSQL instances. It is a check of that single flag, and the control is named for verifying that `log_hostname` is configured appropriately on each instance it covers.
PostgreSQL logs only the IP address of the connecting hosts. The log_hostname flag controls the logging of hostnames in addition to the IP addresses logged.
What this control checks
Checks the log_hostname flag setting on Cloud SQL PostgreSQL instances
Common pitfalls
Performance hit depends on host name resolution setup
The performance hit is dependent on the configuration of the environment and the host name resolution setup.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.sql_instance_postgresql_log_hostname_database_flag_configured.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_108.
Framework-specific interpretation
CIS GCP Benchmark v1.2.0: Mapped to 6.2.8 (Ensure 'log_hostname' database flag for Cloud SQL PostgreSQL instance is set appropriately).
CIS GCP Benchmark v1.3.0: Mapped to 6.2.5 (Ensure 'log_hostname' database flag for Cloud SQL PostgreSQL instance is set appropriately).
Framework mappings
The clauses this control is mapped to in each framework.
- 6.2.8 Ensure 'log_hostname' database flag for Cloud SQL PostgreSQL instance is set appropriately
- 6.2.5 Ensure 'log_hostname' database flag for Cloud SQL PostgreSQL instance is set appropriately
Related controls
- Cloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higher
- Cloud SQL PostgreSQL instances should have 'log_planner_stats' set to 'off'
- Cloud SQL SQL Server instances should not have 'user options' configured
- Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'off'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_postgresql_log_hostname_database_flag_configured - Checkov Check:
CKV_GCP_108 - Powerpipe Control:
gcp_compliance.control.sql_instance_postgresql_log_hostname_database_flag_configured
Last reviewed: 2026-10-10