Review query logging settings for RDS for PostgreSQL

Description

If log_statement and log_min_duration_statement do not meet operational requirements, tracing executed or slow queries in RDS for PostgreSQL can become harder. Basic logs such as login failures and errors still exist without enabling more query logging; this does not mean all logging is disabled.

log_statement selects the statement types to record. log_min_duration_statement uses milliseconds: -1 disables this duration-based logging, 0 records the duration of all statements, and a positive value records statements taking at least that long.

Potential impact

Identifying slow or suspicious queries can become harder.
Diagnosing performance problems can take longer.
Executed query history needed for security investigations can be incomplete.

Remediation

Choose the log_statement scope and log_min_duration_statement threshold according to investigation, audit and workload requirements. Not every environment needs all and 1.
Attach a parameter group for the correct engine family to the instance, then verify its applied status and actual logs. Configure log exports separately if CloudWatch Logs delivery is required.
Query logs can contain passwords or sensitive data. Restrict access and retention, and review collection volume and cost.

Examples

These excerpts configure a parameter group; its attachment to an instance is omitted. The before values not_all and not_1 are not valid PostgreSQL values and must not be used as deployable settings. The after value 1 means one millisecond, not one second, and can produce a large volume of logs.

Before

hcl

resource "aws_db_parameter_group" "postgres_logging" {
  name   = "postgres-logging"
  family = "postgres14"

  parameter {
    name  = "log_statement"
    value = "not_all"
  }

  parameter {
    name  = "log_min_duration_statement"
    value = "not_1"
  }
}

After

hcl

resource "aws_db_parameter_group" "postgres_logging" {
  name   = "postgres-logging"
  family = "postgres14"

  parameter {
    name  = "log_statement"
    value = "all"
  }

  parameter {
    name  = "log_min_duration_statement"
    value = "1"
  }
}

Explanation:

Before: Both parameters have invalid values.
After: This detailed configuration logs all statements and also records durations for statements taking at least one millisecond. Review actual requirements and performance effects before applying it.