PostgreSQL Log Disconnections Flag Should Be Disabled
More Info:
Ensure that the log_disconnections database flag for Cloud SQL PostgreSQL instance is set to on.Risk Level
MediumAddress
SecurityCompliance Standards
CISGCP, CBP, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the PostgreSQL Log Disconnections Flag misconfiguration on GCP using the GCP console, please follow the steps below:
- Open the GCP console and navigate to the Cloud SQL instances page.
- Select the instance that has the PostgreSQL database with the misconfiguration.
- Click on the “Edit” button at the top of the page to edit the instance settings.
- In the “Flags” section, locate the “log_disconnections” flag.
- Set the value of “log_disconnections” to “off” to disable the flag.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the PostgreSQL Log Disconnections Flag Should Be Disabled misconfiguration in GCP using GCP CLI, you can follow the below steps:The output of the above command should be
- Open the Cloud Shell in the GCP console.
- Run the following command to authenticate the gcloud CLI tool:
- Set the project where the PostgreSQL instance is located:
- Get the instance name of the PostgreSQL instance:
- Get the current value of the
log_disconnectionsflag for the PostgreSQL instance:
- If the output of the above command is
ON, then run the following command to disable the flag:
- Verify that the
log_disconnectionsflag is disabled by running the following command:
OFF, which indicates that the flag has been successfully disabled.Using Python
Using Python
To remediate the PostgreSQL Log Disconnections Flag Should Be Disabled misconfiguration on GCP using Python, you can follow these steps:Note that you will need to authenticate with GCP and have the necessary permissions to perform these actions. Also, make sure to test this remediation in a non-production environment before applying it to your production environment.
- Import the necessary libraries:
- Initialize the Logging client:
- Define the project ID and the log name:
- Define the filter to search for the log entries related to the disconnections flag:
- Retrieve the log entries that match the filter:
- For each log entry, extract the instance ID and the zone:
- Disable the PostgreSQL log disconnections flag for each instance: