菜单
Ensure 'cloudsql.enable_pgaudit' Database Flag for each Cloud SQL PostgreSQL Instance Is Set to 'on' For Centralized Logging
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-gcp-foundations-6-2-8命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
正在显示 SKILL.md
基于 SOC 职业分类
| name | cis-gcp-foundations-6.2.8 |
| description | Ensure 'cloudsql.enable_pgaudit' Database Flag for each Cloud SQL PostgreSQL Instance Is Set to 'on' For Centralized Logging |
| category | cis-gcp-foundations |
| version | 4.0.0 |
| author | cyberstrike-official |
| tags | ["cis","gcp","cloud-sql","postgresql"] |
| cis_id | 6.2.8 |
| cis_benchmark | CIS Google Cloud Platform Foundation Benchmark v4.0.0 |
| tech_stack | ["gcp"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Ensure cloudsql.enable_pgaudit database flag for Cloud SQL PostgreSQL instance is set to on to allow for centralized logging.
As numerous other recommendations in this section consist of turning on flags for logging purposes, your organization will need a way to manage these logs. You may have a solution already in place. If you do not, consider installing and enabling the open source pgaudit extension within PostgreSQL and enabling its corresponding flag of cloudsql.enable_pgaudit. This flag and installing the extension enables database auditing in PostgreSQL through the open-source pgAudit extension. This extension provides detailed session and object logging to comply with government, financial, & ISO standards and provides auditing capabilities to mitigate threats by monitoring security events on the instance. Enabling the flag and settings later in this recommendation will send these logs to Google Logs Explorer so that you can access them in a central location. This recommendation is applicable only to PostgreSQL database instances.
Enabling the pgAudit extension can lead to increased data storage requirements and to ensure durability of pgAudit log records in the event of unexpected storage issues, it is recommended to enable the Enable automatic storage increases setting on the instance. Enabling flags via the command line will also overwrite all existing flags, so you should apply all needed flags in the CLI command. Also flags may require a restart of the server to be implemented or will break existing functionality so update your servers at a time of low usage.
Overview page.Edit.Flags.cloudsql.enable_pgaudit flag is set to on.Run the command by providing <INSTANCE_NAME>. Ensure the value of the flag is on.
gcloud sql instances describe <INSTANCE_NAME> --format="json" | jq '.settings|.| .databaseFlags[]|select(.name=="cloudsql.enable_pgaudit")|.value'
SELECT *
FROM pg_extension;
IAM & Admin and hover over it.Audit Logsfilter search for Cloud Composer APIresource.type="cloudsql_database"
logName="projects/<your-project-name>/logs/cloudaudit.googleapis.com%2Fdata_access"
protoPayload.request.@type="type.googleapis.com/google.cloud.sql.audit.v1.PgAuditEntry"
Overview page.Edit.Flags.Add item.cloudsql.enable_pgaudit for the flag name and set the flag to on.Done.Save to update the configuration.Flags on the Overview page.Run the below command by providing <INSTANCE_NAME> to enable cloudsql.enable_pgaudit flag.
gcloud sql instances patch <INSTANCE_NAME> --database-flags cloudsql.enable_pgaudit=on
Note: RESTART is required to get this configuration in effect.
CREATE EXTENSION pgaudit;
Note: there are multiple options here. This command will enable logging for all databases on a server. Please see the customizing database audit logging reference for more flag options.
Overview page.Edit.Flags.Add item.pgaudit.log=all for the flag name and set the flag to on.Done.Save to update the configuration.Flags on the Overview page.Run the command
gcloud sql instances patch <INSTANCE_NAME> --database-flags cloudsql.enable_pgaudit=on,pgaudit.log=all
Note: This command will overwrite all previously set database flags. To keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign ("=").
filter, search for Cloud Composer API.Cloud Composer API.Admin Read and Data Read checkboxes.Save.By default cloudsql.enable_pgaudit is off.
WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/postgres/flags - to see if your instance will be restarted when this patch is submitted.
Note: Some database flag settings can affect instance availability or stability and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.5 Collect Detailed Audit Logs | x | x | |
| v7 | 6.3 Enable Detailed Logging | x | x |