> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Sql admin activity log enabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Cloud SQL Admin Activity Audit Logging Should Be Enabled" misconfiguration for GCP using GCP console, please follow these steps:

        1. Open the Google Cloud Console and navigate to the Cloud SQL instances page.
        2. Select the instance you want to configure.
        3. Click on the "Edit" button at the top of the page.
        4. Scroll down to the "Database flags" section.
        5. Click on the "Add database flag" button.
        6. In the "Flag name" field, enter "log\_admin\_operations".
        7. In the "Flag value" field, enter "on".
        8. Click on the "Save" button at the bottom of the page.

        This will enable Cloud SQL Admin Activity Audit Logging for the selected instance. The logs will be stored in Stackdriver Logging, which you can access from the Cloud Console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Cloud SQL Admin Activity Audit Logging Should Be Enabled" in GCP using GCP CLI, follow the below steps:

        1. Open the Cloud Shell in the GCP console.
        2. Run the following command to enable Cloud SQL Admin Activity Audit Logging for all Cloud SQL instances in the default project:

        ```
        gcloud sql instances patch [INSTANCE_NAME] --database-flags cloudsql.enable_iam_authorization=true,log_admin_operations=true
        ```

        Replace `[INSTANCE_NAME]` with the name of your Cloud SQL instance.

        3. Verify that the audit logging is enabled by running the following command:

        ```
        gcloud sql instances describe [INSTANCE_NAME] --format="get(settings.databaseFlags)"
        ```

        This command will return a list of all the database flags that are set for the Cloud SQL instance. Verify that `log_admin_operations` is set to `on`.

        4. Repeat the above steps for all the Cloud SQL instances in your project.

        By following the above steps, you can remediate the misconfiguration "Cloud SQL Admin Activity Audit Logging Should Be Enabled" for GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the Cloud SQL Admin Activity Audit Logging misconfiguration in GCP using Python, you can follow the below steps:

        1. First, you need to import the required libraries and authenticate to your GCP account using service account credentials.

        ```python theme={null}
        from google.oauth2 import service_account
        from googleapiclient.discovery import build

        credentials = service_account.Credentials.from_service_account_file(
            'path/to/service/account/key.json')
        service = build('logging', 'v2', credentials=credentials)
        ```

        2. Next, you need to create a filter that will identify the Cloud SQL Admin Activity Audit logs.

        ```python theme={null}
        filter_str = 'resource.type="cloudsql_database" AND logName:"cloudsql.googleapis.com/activity" AND protoPayload.methodName:"cloudsql.*"'
        ```

        3. Then, you need to check if there are any sinks already created for the logs.

        ```python theme={null}
        sinks = service.projects().sinks().list(
            project='your-project-id').execute()
        ```

        4. If there are no sinks created, you can create a new sink for the logs.

        ```python theme={null}
        sink_name = 'your-sink-name'
        sink_filter = 'your-filter'
        destination = 'bigquery.googleapis.com/projects/your-project-id/datasets/your-dataset-id'
        sink = {
            'name': sink_name,
            'filter': sink_filter,
            'destination': destination
        }
        response = service.projects().sinks().create(
            project='your-project-id', body=sink).execute()
        ```

        5. Finally, you need to verify that the sink was created successfully.

        ```python theme={null}
        if 'error' in response:
            print('Error creating sink: {}'.format(response['error']))
        else:
            print('Sink created successfully: {}'.format(response['name']))
        ```

        With these steps, you can remediate the Cloud SQL Admin Activity Audit Logging misconfiguration in GCP using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # This finding cannot actually be remediated on a google_logging_metric:
        # Cloud SQL Admin Activity audit logs are always enabled by Google Cloud
        # and cannot be turned on/off or configured via Terraform, Logging API,
        # or any google_logging_* resource.

        # There is no Terraform argument on any Logging Metric resource
        # (google_logging_metric, google_logging_project_bucket_config, sinks, etc.)
        # that enables or disables Cloud SQL Admin Activity Audit Logging.
        # Metrics and sinks can only *consume* those logs once they exist.

        # To address this finding, you must instead verify in the Console that:
        # 1. Audit logs for service "cloudsql.googleapis.com" with log ID
        #    "cloudaudit.googleapis.com/activity" are present in Logs Explorer, and
        # 2. No Logs Router sink (at org/folder/project level) is configured with
        #    an exclusion filter that drops these audit logs.

        # Console steps (manual, non‑Terraform):
        # - Go to Cloud Logging → Logs Explorer.
        # - Run a query like:
        #   logName:"cloudaudit.googleapis.com/activity" AND
        #   protoPayload.serviceName="cloudsql.googleapis.com"
        #   to confirm Admin Activity logs exist.
        # - Go to Cloud Logging → Logs Router and inspect sinks and exclusions;
        #   remove any exclusion expressions that match those Cloud SQL Admin
        #   Activity logs.

        # Because there is no Terraform-exposed setting to enable/disable these
        # logs, `terraform plan` will show no changes related to this control.
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>