> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud Sql Data Access Audit Logging Should Be Enabled

### More Info:

Ensure that Cloud SQL Data Access Logging is configured properly across all users from a project.

### Risk Level

Low

### Address

Security

### Compliance Standards

* HITRUST CSF
* NIST
* NIST CSF
* PCI
* SOC2
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Cloud SQL data access audit logging should be enabled" for GCP using GCP console, please follow the below steps:

        1. Login to the Google Cloud Console.
        2. Navigate to the Cloud SQL instances page.
        3. Select the instance for which you want to enable audit logging.
        4. Click on the "Edit" button at the top of the page.
        5. Scroll down to the "Additional settings" section and click on it.
        6. Under the "Audit logging" section, select the checkbox next to "Audit logs" to enable audit logging.
        7. Choose the destination bucket where logs should be stored.
        8. Click on the "Save" button to save the changes.

        After completing these steps, audit logs for Cloud SQL data access will be enabled and stored in the specified destination bucket.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Cloud SQL Data Access Audit Logging Should Be Enabled" in GCP using GCP CLI, follow these steps:

        1. Open the Cloud Shell in the GCP Console.
        2. Run the following command to enable audit logging for Cloud SQL:

        ```
        gcloud sql instances patch [INSTANCE_NAME] --enable-audit-log
        ```

        Replace `[INSTANCE_NAME]` with the name of your Cloud SQL instance.

        3. Verify that audit logging is enabled by running the following command:

        ```
        gcloud sql instances describe [INSTANCE_NAME] --format="value(settings.auditLogConfig)"
        ```

        This command should return the audit log configuration for your Cloud SQL instance.

        4. If you want to disable audit logging for Cloud SQL, run the following command:

        ```
        gcloud sql instances patch [INSTANCE_NAME] --no-enable-audit-log
        ```

        This will disable audit logging for your Cloud SQL instance.

        Note: Enabling audit logging for Cloud SQL can generate a significant amount of logs, which can impact performance and incur additional costs. It is recommended to configure log retention policies to manage the log data.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Cloud SQL data access audit logging should be enabled" for GCP using python, please follow the below steps:

        1. Create a Cloud SQL instance object using the `google.cloud.sql_v1beta4` library in python:

        ```python theme={null}
        from google.cloud import sql_v1beta4
        from google.cloud.sql_v1beta4 import enums

        project_id = "your-project-id"
        instance_id = "your-instance-id"
        client = sql_v1beta4.SqlInstancesServiceClient()
        instance_path = client.instance_path(project_id, instance_id)
        instance = client.get(instance_path)
        ```

        2. Check if the audit logs are enabled for the Cloud SQL instance:

        ```python theme={null}
        if instance.settings.database_flags.get("cloud_sql_data_access_audit_logs") == "OFF":
            print("Cloud SQL data access audit logging is not enabled.")
        else:
            print("Cloud SQL data access audit logging is already enabled.")
        ```

        3. If the audit logs are not enabled, enable them using the `patch` method:

        ```python theme={null}
        if instance.settings.database_flags.get("cloud_sql_data_access_audit_logs") == "OFF":
            instance.settings.database_flags["cloud_sql_data_access_audit_logs"] = "ON"
            update_mask = {"paths": ["settings.database_flags.cloud_sql_data_access_audit_logs"]}
            operation = client.patch(instance=instance, update_mask=update_mask, instance=instance)
            operation.result()
            print("Cloud SQL data access audit logging has been enabled.")
        else:
            print("Cloud SQL data access audit logging is already enabled.")
        ```

        4. Verify that the audit logs are enabled:

        ```python theme={null}
        instance = client.get(instance_path)
        if instance.settings.database_flags.get("cloud_sql_data_access_audit_logs") == "ON":
            print("Cloud SQL data access audit logging is now enabled.")
        else:
            print("Cloud SQL data access audit logging could not be enabled.")
        ```

        These steps will remediate the misconfiguration "Cloud SQL data access audit logging should be enabled" for GCP using python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # This finding cannot be remediated on the logging metric resource itself:
        # google_logging_metric (gcp-managementandgovernance-logging-metric) only
        # defines metrics over *existing* logs; it cannot turn Cloud SQL Data Access
        # Audit Logs on or off.

        # The actual setting is an Audit Log configuration on the project (or org/folder),
        # which Terraform exposes via google_project_iam_audit_config.

        resource "google_project_iam_audit_config" "cloudsql_data_access" {
          project = "YOUR_PROJECT_ID"  # replace with your GCP project ID

          service = "cloudsql.googleapis.com"

          audit_log_config {
            log_type = "DATA_READ"
          }

          audit_log_config {
            log_type = "DATA_WRITE"
          }

          # Optional: add exempted_members here if required by policy
          # audit_log_config {
          #   log_type         = "DATA_READ"
          #   exempted_members = ["user:EXEMPT_USER@EXAMPLE.COM"]
          # }
        }

        ```

        Cloud SQL Data Access Audit Logging cannot be enabled from a `google_logging_metric`/logging metric; it must be configured as an Audit Log setting on the project (via Console: IAM & Admin → Audit Logs → select “Cloud SQL Admin API” → enable Data Read/Data Write, or via the `google_project_iam_audit_config` resource as shown).

        For verification, `terraform plan` should show a new `google_project_iam_audit_config.cloudsql_data_access` resource with `service = "cloudsql.googleapis.com"` and `audit_log_config` entries for `DATA_READ` and `DATA_WRITE`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/sql/docs/mysql/audit-logging#available-logs](https://cloud.google.com/sql/docs/mysql/audit-logging#available-logs)