Ensure that the "log_hostname" database flag is enabled for your Google Cloud PostgreSQL database instances in order to assist with incident response and tracking usage in an environment utilizing dynamic IP addresses. There is a potential cost to server performance caused by hostname logging.
This rule resolution is part of the Conformity Security & Compliance tool for GCP.
Logging hostnames allows for the association of hostname to IP address at the time of connection. This information can aid with incident response efforts particularly in an environment that utilizes dynamic IP addresses. Logging hostnames may incur overhead on server performance as for each statement logged, DNS resolution will be required to convert IP address to hostname. Depending on the setup, this may be non-negligible. This recommendation is applicable to PostgreSQL database instances only.
Note: Some database flag settings can affect instance availability and/or stability, and eventually remove the PostgreSQL instance from the Google Cloud SQL Service Level Agreement (SLA).
Audit
To determine if the "log_hostname" flag is enabled for your Google Cloud PostgreSQL database instances, perform the following operations:
Remediation / Resolution
To turn on the "log_hostname" database flag for your Google Cloud PostgreSQL database instances, perform the following operations:
References
- Google Cloud Platform (GCP) Documentation
- Cloud SQL for PostgreSQL documentation
- Configure database flags
- Edit instances
- CIS Security Documentation
- Securing Google Cloud Computing Platform
- GCP Command Line Interface (CLI) Documentation
- gcloud projects list
- gcloud sql instances list
- gcloud sql instances describe
- gcloud sql instances patch