feat(google_cloudsql_postgres): add log metrics for automated backups

google_cloudsql_postgres/README.md

@@ -39,6 +39,8 @@ module "postgres_database" {
 
   db_cpu    = 4
   db_mem_gb = 20
+
+  automated_backup_log_metric_enabled = true
 }
 
 output "postgres_database" {
@@ -101,6 +103,7 @@ module "postgres_database" {
 |------|-------------|------|---------|:--------:|
 | <a name="input_application"></a> [application](#input\_application) | Application e.g., bouncer. | `string` | n/a | yes |
 | <a name="input_authorized_networks"></a> [authorized\_networks](#input\_authorized\_networks) | A list of authorized\_network maps: https://www.terraform.io/docs/providers/google/r/sql_database_instance.html | `list(any)` | `[]` | no |
+| <a name="input_automated_backup_log_metric_enabled"></a> [automated\_backup\_log\_metric\_enabled](#input\_automated\_backup\_log\_metric\_enabled) | Create a log-based metric counting automated backup outcomes by window status. See: https://cloud.google.com/sql/docs/postgres/backup-recovery/view-audit-logs-for-automated-backups | `bool` | `false` | no |
 | <a name="input_availability_type"></a> [availability\_type](#input\_availability\_type) | high availability (REGIONAL) or single zone (ZONAL) | `string` | `"REGIONAL"` | no |
 | <a name="input_backup_configuration_enabled"></a> [backup\_configuration\_enabled](#input\_backup\_configuration\_enabled) | n/a | `bool` | `true` | no |
 | <a name="input_backup_configuration_location"></a> [backup\_configuration\_location](#input\_backup\_configuration\_location) | n/a | `string` | `"us"` | no |

google_cloudsql_postgres/examples/minimal/main.tf

@@ -32,6 +32,8 @@ module "postgres_database" {
 
   db_cpu    = 4
   db_mem_gb = 20
+
+  automated_backup_log_metric_enabled = true
 }
 
 output "postgres_database" {

google_cloudsql_postgres/main.tf

@@ -230,3 +230,31 @@ resource "google_sql_database_instance" "replica" {
 
   deletion_protection = var.deletion_protection
 }
+
+# Counts automated backup outcomes by window status (STATUS_SUCCEEDED, STATUS_FAILED, ...).
+# See https://cloud.google.com/sql/docs/postgres/backup-recovery/view-audit-logs-for-automated-backups
+resource "google_logging_metric" "automated_backup" {
+  count   = var.automated_backup_log_metric_enabled ? 1 : 0
+  project = google_sql_database_instance.primary.project
+  name    = "${local.database_name}-automated-backup"
+  filter  = <<-EOT
+    logName="projects/${google_sql_database_instance.primary.project}/logs/cloudaudit.googleapis.com%2Fsystem_event"
+    protoPayload.methodName="cloudsql.instances.automatedBackup"
+    resource.type="cloudsql_database"
+    resource.labels.database_id="${google_sql_database_instance.primary.project}:${google_sql_database_instance.primary.name}"
+  EOT
+
+  metric_descriptor {
+    metric_kind = "DELTA"
+    value_type  = "INT64"
+    labels {
+      key         = "window_status"
+      value_type  = "STRING"
+      description = "Automated backup window status"
+    }
+  }
+
+  label_extractors = {
+    "window_status" = "EXTRACT(protoPayload.metadata.windowStatus)"
+  }
+}

google_cloudsql_postgres/variables.tf

@@ -346,3 +346,9 @@ variable "final_backup_retention_days" {
   description = "Retention days for final backup. See: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance#retention_days-1"
   type        = number
 }
+
+variable "automated_backup_log_metric_enabled" {
+  default     = false
+  description = "Create a log-based metric counting automated backup outcomes by window status. See: https://cloud.google.com/sql/docs/postgres/backup-recovery/view-audit-logs-for-automated-backups"
+  type        = bool
+}