Cloud SQL PostgreSQL instances should have 'log_parser_stats' set to 'off'

The PostgreSQL planner/optimizer parses and verifies the syntax of each query. The `log_parser_stats` flag controls the inclusion of parser performance statistics in the PostgreSQL logs for each query. This control checks that it is set to 'off'.

The PostgreSQL planner/optimizer is responsible to parse and verify the syntax of each query received by the server. The log_parser_stats flag controls the inclusion of parser performance statistics in the PostgreSQL logs for each query.

What this control checks

Cloud SQL PostgreSQL instances must have the log_parser_stats database flag set to 'off'.

Common pitfalls

Check passes when no database flags exist

The check passes if settings.database_flags[*] does not exist. The check passes if database_version does not contain POSTGRES.

Audit evidence

Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.sql_instance_postgresql_log_parser_stats_database_flag_off.

Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_GCP_15.

Framework-specific interpretation

CIS GCP Benchmark v1.2.0: Mapped to 6.2.9 (Ensure 'log_parser_stats' database flag for Cloud SQL PostgreSQL instance is set to 'off').

Framework mappings

The clauses this control is mapped to in each framework.

CIS GCP Benchmark v1.2.0

6.2.9 Ensure 'log_parser_stats' database flag for Cloud SQL PostgreSQL instance is set to 'off'

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: sql_instance_postgresql_log_parser_stats_database_flag_off
Checkov Check: CKV2_GCP_15
Powerpipe Control: gcp_compliance.control.sql_instance_postgresql_log_parser_stats_database_flag_off

Last reviewed: 2026-10-10

View all Google Cloud controls →