Back to Checks
alibabacloud

Logging is enabled for OSS buckets

oss_bucket_logging_enabled
Service: ossSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:ALIYUN::OSS::Bucket

Alibaba Cloud OSS Bucket Access Logging generates a log record for each request made to your OSS bucket, containing details such as the request type, the resources specified, and the time and date the request was processed. Enabling bucket access logging on all OSS buckets ensures that access patterns are recorded and available for security analysis and incident response workflows.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without OSS bucket logging enabled, access events affecting objects within target buckets are not captured. This limits the ability to perform security analysis, incident response, and forensic investigations, as there is no record of who accessed or modified stored data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks oss_bucket_logging_enabled

Recommendation

Enable access logging on all OSS buckets and configure logs to be stored in a separate dedicated bucket for security analysis and compliance auditing.

Remediation

CLI

ossutil logging --method put oss://<bucket-name> --target-bucket <target-bucket> --target-prefix <prefix>

Terraform

resource "alicloud_oss_bucket_logging" "example" {
  bucket        = alicloud_oss_bucket.example.bucket
  target_bucket = alicloud_oss_bucket.log_bucket.bucket
  target_prefix = "log/"
}

Other

1Log on to the **OSS Console**
2In the bucket-list pane, click on a target OSS bucket
3Under **Log**, click **Configure**
4Click the **Enabled** checkbox
5Select `Target Bucket` from the list
6Enter a `Target Prefix`
7Click **Save**

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.oss.oss_client import oss_client


class oss_bucket_logging_enabled(Check):
    """Check if logging is enabled for OSS buckets."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for bucket in oss_client.buckets.values():
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=bucket)
            report.region = bucket.region
            report.resource_id = bucket.name
            report.resource_arn = bucket.arn

            if bucket.logging_enabled:
                report.status = "PASS"
                if bucket.logging_target_bucket:
                    report.status_extended = (
                        f"OSS bucket {bucket.name} has logging enabled. "
                        f"Logs are stored in bucket '{bucket.logging_target_bucket}' "
                        f"with prefix {bucket.logging_target_prefix}."
                    )
                else:
                    report.status_extended = (
                        f"OSS bucket {bucket.name} has logging enabled."
                    )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"OSS bucket {bucket.name} does not have logging enabled."
                )

            findings.append(report)

        return findings

References