# 6.2.4 Ensure ‘Log_statement’ Database Flag for Cloud SQL PostgreSQL Instance Is Set Appropriately (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233035-6-2-4-ensure-log-statement-database-flag-for-cloud-sql-postgresql-instance-is-set-appropriately-au - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: - Level 2 Description: The log\_statement database flag in PostgreSQL controls the logging of SQL statements based on their type. The valid values for this flag are: - none: No statements are logged. - ddl: Logs only data definition language (DDL) statements (e.g., CREATE, ALTER, DROP). - mod: Logs all DDL statements plus data-modifying statements (e.g., INSERT, UPDATE, DELETE). - all: Logs all types of SQL statements, including those with errors. The recommended value is 'ddl', unless specified otherwise by your organization's logging policy. Rationale: Auditing and logging SQL statements are crucial for forensic analysis and troubleshooting. Setting the log\_statement flag to an appropriate level ensures that relevant activity is logged without overwhelming the logs with unnecessary data. Too many logged statements can make it difficult to find useful information, while too few can result in missing critical data. Aligning this setting with your security and logging policies will help streamline audit processes and enhance visibility. Impact: - Enabling logging increases storage requirements over time. - Improper log management may cause storage costs to rise. - Setting custom flags via command line might overwrite existing flags, potentially leading to loss of custom settings and requiring instance restarts. Changes should be made during off-peak hours to mitigate these issues. Default Value: By default, the log\_statement flag is set to 'none' (no statements are logged). Audit Steps: #### Using Google Cloud Console: 1. Navigate to the [Cloud SQL Instances](https://console.cloud.google.com/sql/instances) page.                     ![](https://support.icompaas.com/assets/kb/9017721477676a15.png) 2. Select the PostgreSQL instance to view its Instance Overview page.       ![](https://support.icompaas.com/assets/kb/8f67bcdf29728005.png). 3. Go to the Configuration card.                          ![](https://support.icompaas.com/assets/kb/af3e4bda7f9d4494.png) 4. Ensure the value of the log\_statement flag is set as expected (typically to ddl or stricter).                      ![](https://support.icompaas.com/assets/kb/3b690904f71a9706.png) #### Using Google Cloud CLI: List all Cloud SQL PostgreSQL instances: gcloud sql instances list --format=json Verify the log\_statement flag value for each instance: gcloud sql instances describe \[INSTANCE\_NAME\] --format=json | jq '.settings.databaseFlags\[\] | select(.name=="log\_statement")|.value' Remediation Steps: #### Using Google Cloud Console: 1. Go to the [Cloud SQL Instances](https://console.cloud.google.com/sql/instances) page.                       ![](https://support.icompaas.com/assets/kb/6770f0d6cc3c86db.png) 2. Select the PostgreSQL instance that needs to be updated.     ![](https://support.icompaas.com/assets/kb/9529a122270b09c5.png) 3. Click Edit.         ![](https://support.icompaas.com/assets/kb/9cce29e362e6b27b.png) 4. Scroll to the Flags section.                 ![](https://support.icompaas.com/assets/kb/00bb93cd981ded19.png) 5. If the log\_statement flag is not set, click Add a Database Flag, select log\_statement from the dropdown menu, and set its value to the desired level (ddl, mod, or all).                       ![](https://support.icompaas.com/assets/kb/5f0f33ba33d6b7a8.png) 6. Click Save to apply the changes.                                 ![](https://support.icompaas.com/assets/kb/7f20ecfc8eae1a23.png) 7. Confirm the changes under Flags on the Overview page.       ![](https://support.icompaas.com/assets/kb/622b7bd0ccd2932e.png) #### Using Google Cloud CLI: Use the following command to configure the log\_statement flag for a PostgreSQL instance: gcloud sql instances patch \[INSTANCE\_NAME\] --database-flags log\_statement=\[ddl|mod|all\] 1. Note: This command will overwrite any previously set flags. Ensure to include all the desired flags in the command to avoid resetting any other custom configurations. ## Backout Plan: ### Step 1: Revert log\_statement Configuration If you need to revert the log\_statement flag to its default value, set it to none: gcloud sql instances patch \[INSTANCE\_NAME\] --database-flags log\_statement=non ### Step 2: Verify Changes Ensure the configuration change has been applied successfully: gcloud sql instances describe \[INSTANCE\_NAME\] --format=json | jq '.settings.databaseFlags\[\] | select(.name=="log\_statement")|.value' ### Step 3: Notify Stakeholders - Inform the relevant stakeholders (e.g., security and operations teams) that the logging settings have been reverted. - Discuss any potential adjustments needed to align the logging configuration with organizational policies. References: 1. [Google Cloud SQL Database Flags Documentation](https://cloud.google.com/sql/docs/postgres/flags) 2. [PostgreSQL Runtime Configuration Logging](https://www.postgresql.org/docs/current/runtime-config-logging.html#RUNTIMECONFIG-LOGGING-WHAT) Additional Information: - Configuring the log\_statement flag will not require a restart for the Cloud SQL instance. - **Some database flags may affect instance availability or stability, and may impact the Cloud SQL SLA. For more details, check the [Operational Guidelines](https://cloud.google.com/sql/docs/postgres/flags).** **CIS Controls:**

Control

Description

IG 1

IG 2

IG 3

8.5 Collect Detailed Audit Logs

Enable detailed audit logging to capture data useful for forensic analysis, including event sources, timestamps, and user information.

✅

✅

✅

6.3 Enable Detailed Logging

Ensure that system logs include essential information such as source, date, user, and destination addresses for effective monitoring.

✅

✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.