To identify AlloyDB for PostgreSQL production instances that don't have database auditing enabled and improve your security posture, you can view and apply recommendations from the AlloyDB database auditing recommender.
Before you begin
Before you can view recommendations and insights, do the following:
To get the permissions to view and work with insights and recommendations, ask your administrator to grant you the required Identity and Access Management (IAM) roles:
Tasks Roles View recommendations AlloyDB Recommender Viewer ( roles/recommender.alloydbViewer)Apply recommendations AlloyDB Recommender Admin ( roles/recommender.alloydbAdmin) or AlloyDB Admin (roles/alloydb.admin)See Grant access to other users for more information.
List the recommendations
You can list recommendations for enabling database auditing by using the Google Cloud console, gcloud CLI, or the Recommender API.
Console
In the Google Cloud console, go to the Clusters page.
For more information, see Find recommendations with Active Assist.
In the Resources list table, find the cluster and click View issues in the Issues column.
A list of issues is displayed in the Aggregated issues panel. Select the Auditing not enabled recommendation card.
gcloud CLI
To list recommendations for enabling database auditing by using the
gcloud CLI, run the
gcloud recommender recommendations list
command as follows:
gcloud recommender recommendations list \ --project=PROJECT_ID \ --location=LOCATION \ --recommender=google.alloydb.instance.SecurityRecommender \ --filter=recommenderSubtype=ENABLE_DATABASE_AUDITING
Replace the following:
PROJECT_ID: your project ID.LOCATION: the region where your instances are located, such asus-central1.
API
To list recommendations for enabling database auditing by using the
Recommender API, call the
recommendations.list
method as follows:
GET https://recommender.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/recommenders/google.alloydb.instance.SecurityRecommender/recommendations?filter=recommenderSubtype=ENABLE_DATABASE_AUDITING
Replace the following:
PROJECT_ID: your project ID.LOCATION: the region where your instances are located, such asus-central1.
View insights and detailed recommendations
You can view insights and detailed recommendations about instances that require enabling database auditing by using the Google Cloud console, gcloud CLI, or the Recommender API.
Console
On the Clusters page, under the Resources table, click View issues in the Issues column for the cluster.
The Aggregated issues panel appears on the right, which contains insights and detailed recommendations for Auditing not enabled.
gcloud CLI
Run the
gcloud recommender insights list
command as follows:
gcloud recommender insights list \ --project=PROJECT_ID \ --location=LOCATION \ --insight-type=google.alloydb.instance.SecurityInsight \ --filter=insightSubtype=DATABASE_AUDITING_NOT_ENABLED
Replace the following:
PROJECT_ID: your project ID.LOCATION: the region where your instances are located, such asus-central1.
API
Call the
insights.list
method as follows:
GET https://recommender.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/insightTypes/google.alloydb.instance.SecurityInsight/insights?filter=insightSubtype=DATABASE_AUDITING_NOT_ENABLED
Replace the following:
PROJECT_ID: your project ID.LOCATION: the region where your instances are located, such asus-central1.
Apply the recommendation
Evaluate the recommendation carefully and do any of the following:
Console
To implement the recommendation, follow the instructions in Enable pgAudit.
gcloud CLI
To implement the recommendation, follow the instructions in Enable pgAudit.