Cloud SQL PostgreSQL instances should have 'log_lock_waits' set to 'on'
This control inspects Cloud SQL PostgreSQL instances and requires the `log_lock_waits` database flag to be set to `on`. The check applies to the database flag configuration of each Cloud SQL PostgreSQL instance and looks at the value set for `log_lock_waits`.
Lock waits are often an indication of poor performance and often an indicator of a potential denial of service vulnerability, therefore occurrences should be logged for analysis.
What this control checks
Cloud SQL PostgreSQL instances must have the log_lock_waits database flag set to on
Common pitfalls
Flag must be explicitly set to on
Must be explicitly set for check to pass.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.sql_instance_postgresql_log_lock_waits_database_flag_on.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_54; Trivy check GCP-0020.
Framework-specific interpretation
CIS GCP Benchmark v1.2.0: Mapped to 6.2.6 (Ensure that the 'log_lock_waits' database flag for Cloud SQL PostgreSQL instance is set to 'on').
Framework mappings
The clauses this control is mapped to in each framework.
- 6.2.6 Ensure that the 'log_lock_waits' database flag for Cloud SQL PostgreSQL instance is set to 'on'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_postgresql_log_lock_waits_database_flag_on - Checkov Check:
CKV_GCP_54 - Powerpipe Control:
gcp_compliance.control.sql_instance_postgresql_log_lock_waits_database_flag_on - Trivy Check:
GCP-0020
Last reviewed: 2026-10-10