Defining a short log retention duration can reduce an organization’s ability to backtrace the actions of malicious actors in case of a security
incident.
Logging allows operational and security teams to get detailed and real-time feedback on an information system’s events. The logging coverage
enables them to quickly react to events, ranging from the most benign bugs to the most impactful security incidents, such as intrusions.
Apart from security detection, logging capabilities also directly influence future digital forensic analyses. For example, detailed logging will
allow investigators to establish a timeline of the actions perpetrated by an attacker.
Ask Yourself Whether
- This component is essential for the information system infrastructure.
- This component is essential for mission-critical functions.
- Compliance policies require traceability for a longer duration.
There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices
Increase the log retention period to an amount of time sufficient enough to be able to investigate and restore service in case of an incident.
Sensitive Code Example
For AWS Cloudwatch Logs:
resource "aws_cloudwatch_log_group" "example" {
name = "example"
retention_in_days = 3 # Sensitive
}
For Azure Firewall Policy:
resource "azurerm_firewall_policy" "example" {
insights {
enabled = true
retention_in_days = 7 # Sensitive
}
}
For Google Cloud Logging buckets:
resource "google_logging_project_bucket_config" "example" {
project = var.project
location = "global"
retention_days = 7 # Sensitive
bucket_id = "_Default"
}
Compliant Solution
For AWS Cloudwatch Logs:
resource "aws_cloudwatch_log_group" "example" {
name = "example"
retention_in_days = 30
}
For Azure Firewall Policy:
resource "azurerm_firewall_policy" "example" {
insights {
enabled = true
retention_in_days = 30
}
}
For Google Cloud Logging buckets:
resource "google_logging_project_bucket_config" "example" {
project = var.project
location = "global"
retention_days = 30
bucket_id = "_Default"
}
