> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SQL Query Insights should be Enabled

### More Info:

Ensure that SQL Instances have Query Insights enabled.

### Risk Level

Low

### Address

Operational Maturity

### Compliance Standards

* Cloudanix Best Practice

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "SQL Query Insights should be Enabled" for GCP using the GCP Console, follow the below steps:

        1. Open the GCP Console and go to the Cloud SQL Instances page.
        2. Select the instance for which you want to enable SQL Query Insights.
        3. Click on the "Edit" button at the top of the page.
        4. Scroll down to the "Flags" section and click on the "Add item" button.
        5. In the "Name" field, enter "query-insights-enabled".
        6. In the "Value" field, enter "on".
        7. Click on the "Save" button at the bottom of the page to save the changes.

        After following the above steps, SQL Query Insights will be enabled for the selected Cloud SQL instance in GCP.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the SQL Query Insights misconfiguration for GCP using GCP CLI, follow these steps:

        1. Open the Cloud Shell in the GCP Console.

        2. Run the following command to enable SQL Query Insights for a Cloud SQL instance:

           ```
           gcloud sql instances patch [INSTANCE_NAME] --database-flags cloudsql.enable_query_log=on
           ```

           Replace `[INSTANCE_NAME]` with the name of your Cloud SQL instance.

        3. Verify that SQL Query Insights is enabled by running the following command:

           ```
           gcloud sql instances describe [INSTANCE_NAME] | grep queryLog
           ```

           If SQL Query Insights is enabled, the output should include `"queryLogConfig": {"enableQueryLog": true}`.

        That's it! SQL Query Insights should now be enabled for your Cloud SQL instance in GCP.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "SQL Query Insights should be Enabled" in GCP using Python, follow these steps:

        1. Import the necessary libraries:

        ```python theme={null}
        from google.cloud import bigquery
        from google.cloud.bigquery import QueryJobConfig
        ```

        2. Create a client object for the BigQuery API:

        ```python theme={null}
        client = bigquery.Client()
        ```

        3. Define the project ID and dataset ID where the query insights should be enabled:

        ```python theme={null}
        project_id = 'your-project-id'
        dataset_id = 'your-dataset-id'
        ```

        4. Enable query insights for the dataset:

        ```python theme={null}
        dataset_ref = client.dataset(dataset_id, project=project_id)
        dataset = client.get_dataset(dataset_ref)
        dataset.default_query_job_config.use_query_cache = False
        dataset.default_query_job_config.use_legacy_sql = False
        dataset.default_query_job_config.labels = {"queryinsights-enabled": "true"}
        client.update_dataset(dataset, ["labels"])
        ```

        This code will update the dataset with a label "queryinsights-enabled" set to "true", which will enable query insights for the dataset.

        Note: To run this code, you need to have the necessary permissions to update the dataset in GCP.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_sql_database_instance" "PRIMARY_INSTANCE" {
          name             = "PRIMARY_INSTANCE_NAME"        # replace with your instance name
          database_version = "POSTGRES_14"                  # replace with your engine/version
          region           = "INSTANCE_REGION"              # e.g. "us-central1"

          settings {
            tier = "db-custom-2-7680"                       # replace with your machine tier

            insights_config {
              query_insights_enabled  = true
              # Optional tuning – set thresholds to match your policy:
              # Maximum length of recorded query strings (1–4500, default 1024)
              query_string_length     = 1024
              # Enable if you want client address recorded
              record_client_address   = true
              # Enable if you want application tags (e.g. from PG labels) recorded
              record_application_tags = true
              # For Cloud SQL for PostgreSQL only: limit of query plans captured per minute (0–20)
              # query_plans_per_minute = 5
            }
          }
        }
        ```

        Enabling Query Insights via `insights_config.query_insights_enabled = true` does not force replacement of the Cloud SQL instance; Terraform will show an in‑place update on the `settings.insights_config` block in `terraform plan`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>