turbot/gcp_compliance

Query: sql_instance_postgresql_cloudsql_pgaudit_database_flag_enabled

Usage

powerpipe query gcp_compliance.query.sql_instance_postgresql_cloudsql_pgaudit_database_flag_enabled

SQL

select
self_link resource,
case
when database_version not like 'POSTGRES%' then 'skip'
when database_flags @> '[{"name":"cloudsql.enable_pgaudit","value":"on"}]' then 'ok'
else 'alarm'
end as status,
case
when database_version not like 'POSTGRES%' then title || ' not a PostgreSQL database.'
when database_flags is null
or not (
database_flags @> '[{"name":"cloudsql.enable_pgaudit"}]'
) then title || ' ''cloudsql.enable_pgaudit'' database flag not set.'
when database_flags @> '[{"name":"cloudsql.enable_pgaudit","value":"on"}]' then title || ' ''cloudsql.enable_pgaudit'' database flag enabled.'
else title || ' ''cloudsql.enable_pgaudit'' database flag disabled.'
end as reason,
location as location,
project as project
from
gcp_sql_database_instance;

Controls

The query is being used by the following controls: