Back to Checks
alibabacloud

Logstore data retention period is set to the recommended period (default 365 days)

sls_logstore_retention_period
Service: slsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:ALIYUN::SLS::Logstore

Alibaba Cloud Simple Log Service (SLS) Logstore data retention should be configured for at least 365 days. The Logstore retention period controls how long activity logs are stored and available for analysis. Ensuring a minimum retention of 365 days provides sufficient time to investigate security incidents, perform forensic analysis, and meet regulatory compliance requirements.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Insufficient log retention may result in loss of forensic evidence for security investigations. If logs are deleted before an incident is detected, determining the scope and root cause of breaches becomes impossible. Short retention may also cause compliance violations with regulations mandating specific durations, affecting integrity and accountability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks sls_logstore_retention_period

Recommendation

  1. Log on to the SLS Console
  2. Find the project in the Projects section
  3. Click Modify icon next to the Logstore
  4. Modify the Data Retention Period to 365 or greater

Remediation

CLI

aliyun sls update-logstore --project <project-name> --logstore <logstore-name> --ttl 365

Terraform

resource "alicloud_log_store" "example" {
  project  = alicloud_log_project.example.name
  name     = "example-logstore"
  retention_period = 365
}

Other

1Log on to the **SLS Console**.
2Find the project in the **Projects** section.
3Click the **Modify** icon next to the target Logstore.
4Set the `Data Retention Period` to `365` days or greater.
5Click **Save** to apply the changes.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.sls.sls_client import sls_client


class sls_logstore_retention_period(Check):
    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        # Get configurable max days from audit config (default: 365 days)
        min_log_retention_days = sls_client.audit_config.get(
            "min_log_retention_days", 365
        )

        for log_store in sls_client.log_stores:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=log_store
            )
            report.resource_id = log_store.name
            report.resource_arn = log_store.arn
            report.region = log_store.region

            # Check retention
            if log_store.retention_days >= min_log_retention_days:
                report.status = "PASS"
                report.status_extended = f"SLS LogStore {log_store.name} in project {log_store.project} has retention set to {log_store.retention_days} days (>= {min_log_retention_days} days)."
            else:
                report.status = "FAIL"
                report.status_extended = f"SLS LogStore {log_store.name} in project {log_store.project} has retention set to {log_store.retention_days} days (less than {min_log_retention_days} days)."

            findings.append(report)

        return findings

References