PostgreSQL log connections disabled

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: ansible-gcp-postgresql-log-connections-disabled

Provider: GCP

Platform: Ansible

Severity: Medium

Category: Observability

Learn More

Description

PostgreSQL Cloud SQL instances must have the log_connections flag set to on so connection events are recorded for auditing and to help detect suspicious or unauthorized access. For Ansible resources using google.cloud.gcp_sql_instance or gcp_sql_instance, the settings.databaseFlags property must include an entry with name: log_connections and value: on. Resources missing settings or settings.databaseFlags, or where log_connections is absent or set to off, are flagged.

Secure Ansible example:

- name: Create PostgreSQL Cloud SQL instance with connection logging enabled
  google.cloud.gcp_sql_instance:
    name: my-postgres-instance
    database_version: POSTGRES_13
    settings:
      tier: db-custom-1-3840
      databaseFlags:
        - name: log_connections
          value: "on"

Compliant Code Examples

- name: create a instance
  google.cloud.gcp_sql_instance:
    name: my-postgres-instance
    settings:
      databaseFlags:
      - name: log_connections
        value: on
      tier: db-n1-standard-1
    region: us-central1
    project: test_project
    database_version: POSTGRES_9_6
    auth_kind: serviceaccount
    service_account_file: /tmp/auth.pem
    state: present

Non-Compliant Code Examples

- name: create instance
  google.cloud.gcp_sql_instance:
    name: my-postgres-instance
    settings:
      databaseFlags:
      - name: log_connections
        value: off
      tier: db-n1-standard-1
    region: us-central1
    project: test_project
    database_version: POSTGRES_9_6
    auth_kind: serviceaccount
    service_account_file: "/tmp/auth.pem"
    state: present
- name: create another instance
  google.cloud.gcp_sql_instance:
    name: my-postgres-instance-2
    settings:
      tier: db-n1-standard-1
    region: us-central1
    project: test_project
    database_version: POSTGRES_9_6
    auth_kind: serviceaccount
    service_account_file: "/tmp/auth.pem"
    state: present