From acfbd05f55abe5418f4fc38024804204cc1f7cc4 Mon Sep 17 00:00:00 2001 From: Nate Tade Date: Thu, 24 Sep 2026 14:49:25 -0700 Subject: [PATCH 1/3] feat(google_cloudsql_postgres): add log metrics for automated backups --- google_cloudsql_postgres/README.md | 4 +++ .../examples/minimal/main.tf | 2 ++ google_cloudsql_postgres/main.tf | 28 +++++++++++++++++++ google_cloudsql_postgres/outputs.tf | 4 +++ google_cloudsql_postgres/variables.tf | 6 ++++ 5 files changed, 44 insertions(+) diff --git a/google_cloudsql_postgres/README.md b/google_cloudsql_postgres/README.md index f190eb86..e61df084 100644 --- a/google_cloudsql_postgres/README.md +++ b/google_cloudsql_postgres/README.md @@ -39,6 +39,8 @@ module "postgres_database" { db_cpu = 4 db_mem_gb = 20 + + automated_backup_log_metric_enabled = true } output "postgres_database" { @@ -101,6 +103,7 @@ module "postgres_database" { |------|-------------|------|---------|:--------:| | [application](#input\_application) | Application e.g., bouncer. | `string` | n/a | yes | | [authorized\_networks](#input\_authorized\_networks) | A list of authorized\_network maps: https://www.terraform.io/docs/providers/google/r/sql_database_instance.html | `list(any)` | `[]` | no | +| [automated\_backup\_log\_metric\_enabled](#input\_automated\_backup\_log\_metric\_enabled) | Create a log-based metric counting automated backup outcomes by window status. See: https://cloud.google.com/sql/docs/postgres/backup-recovery/view-audit-logs-for-automated-backups | `bool` | `false` | no | | [availability\_type](#input\_availability\_type) | high availability (REGIONAL) or single zone (ZONAL) | `string` | `"REGIONAL"` | no | | [backup\_configuration\_enabled](#input\_backup\_configuration\_enabled) | n/a | `bool` | `true` | no | | [backup\_configuration\_location](#input\_backup\_configuration\_location) | n/a | `string` | `"us"` | no | @@ -160,6 +163,7 @@ module "postgres_database" { | Name | Description | |------|-------------| +| [automated\_backup\_log\_metric\_type](#output\_automated\_backup\_log\_metric\_type) | n/a | | [connection\_name](#output\_connection\_name) | n/a | | [database\_instance](#output\_database\_instance) | n/a | | [db\_instance\_ip](#output\_db\_instance\_ip) | n/a | diff --git a/google_cloudsql_postgres/examples/minimal/main.tf b/google_cloudsql_postgres/examples/minimal/main.tf index ee963815..07b90130 100644 --- a/google_cloudsql_postgres/examples/minimal/main.tf +++ b/google_cloudsql_postgres/examples/minimal/main.tf @@ -32,6 +32,8 @@ module "postgres_database" { db_cpu = 4 db_mem_gb = 20 + + automated_backup_log_metric_enabled = true } output "postgres_database" { diff --git a/google_cloudsql_postgres/main.tf b/google_cloudsql_postgres/main.tf index 71cc432a..6fc05782 100644 --- a/google_cloudsql_postgres/main.tf +++ b/google_cloudsql_postgres/main.tf @@ -230,3 +230,31 @@ resource "google_sql_database_instance" "replica" { deletion_protection = var.deletion_protection } + +# Counts automated backup outcomes by window status (STATUS_SUCCEEDED, STATUS_FAILED, ...). +# See https://cloud.google.com/sql/docs/postgres/backup-recovery/view-audit-logs-for-automated-backups +resource "google_logging_metric" "automated_backup" { + count = var.automated_backup_log_metric_enabled ? 1 : 0 + project = google_sql_database_instance.primary.project + name = "${local.database_name}-automated-backup" + filter = <<-EOT + logName="projects/${google_sql_database_instance.primary.project}/logs/cloudaudit.googleapis.com%2Fsystem_event" + protoPayload.methodName="cloudsql.instances.automatedBackup" + resource.type="cloudsql_database" + resource.labels.database_id="${google_sql_database_instance.primary.project}:${google_sql_database_instance.primary.name}" + EOT + + metric_descriptor { + metric_kind = "DELTA" + value_type = "INT64" + labels { + key = "window_status" + value_type = "STRING" + description = "Automated backup window status" + } + } + + label_extractors = { + "window_status" = "EXTRACT(protoPayload.metadata.windowStatus)" + } +} diff --git a/google_cloudsql_postgres/outputs.tf b/google_cloudsql_postgres/outputs.tf index 1adabb36..e7946702 100644 --- a/google_cloudsql_postgres/outputs.tf +++ b/google_cloudsql_postgres/outputs.tf @@ -50,3 +50,7 @@ output "replica_public_ip_address" { output "tier" { value = local.tier } + +output "automated_backup_log_metric_type" { + value = var.automated_backup_log_metric_enabled ? "logging.googleapis.com/user/${google_logging_metric.automated_backup[0].name}" : null +} diff --git a/google_cloudsql_postgres/variables.tf b/google_cloudsql_postgres/variables.tf index f4782c9d..0bde809d 100644 --- a/google_cloudsql_postgres/variables.tf +++ b/google_cloudsql_postgres/variables.tf @@ -346,3 +346,9 @@ variable "final_backup_retention_days" { description = "Retention days for final backup. See: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance#retention_days-1" type = number } + +variable "automated_backup_log_metric_enabled" { + default = false + description = "Create a log-based metric counting automated backup outcomes by window status. See: https://cloud.google.com/sql/docs/postgres/backup-recovery/view-audit-logs-for-automated-backups" + type = bool +} From b01cbd68e4436cf7cb715dba27eb27d8c8896dc4 Mon Sep 17 00:00:00 2001 From: Nate Tade Date: Thu, 24 Sep 2026 15:03:55 -0700 Subject: [PATCH 2/3] remove unneeded output --- google_cloudsql_postgres/outputs.tf | 4 ---- 1 file changed, 4 deletions(-) diff --git a/google_cloudsql_postgres/outputs.tf b/google_cloudsql_postgres/outputs.tf index e7946702..1adabb36 100644 --- a/google_cloudsql_postgres/outputs.tf +++ b/google_cloudsql_postgres/outputs.tf @@ -50,7 +50,3 @@ output "replica_public_ip_address" { output "tier" { value = local.tier } - -output "automated_backup_log_metric_type" { - value = var.automated_backup_log_metric_enabled ? "logging.googleapis.com/user/${google_logging_metric.automated_backup[0].name}" : null -} From 7798d4408554b183c75bd71f99eb4750ecf32b15 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 24 Sep 2026 22:04:30 +0000 Subject: [PATCH 3/3] chore(docs): google_cloudsql_postgres/README.md --- google_cloudsql_postgres/README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/google_cloudsql_postgres/README.md b/google_cloudsql_postgres/README.md index e61df084..aa7b8395 100644 --- a/google_cloudsql_postgres/README.md +++ b/google_cloudsql_postgres/README.md @@ -163,7 +163,6 @@ module "postgres_database" { | Name | Description | |------|-------------| -| [automated\_backup\_log\_metric\_type](#output\_automated\_backup\_log\_metric\_type) | n/a | | [connection\_name](#output\_connection\_name) | n/a | | [database\_instance](#output\_database\_instance) | n/a | | [db\_instance\_ip](#output\_db\_instance\_ip) | n/a |