Back to Checks
oraclecloud

Tenancy audit log retention period is 365 days or greater

audit_log_retention_period_365_days
Service: auditSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:Compartment

OCI Audit configuration defines tenancy-wide log retention for audit events. The finding evaluates whether the retention period (days) is >= 365 and that an audit configuration exists, applying across all regions and compartments.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Insufficient audit retention or missing configuration shrinks the detection window and breaks accountability.

Evidence for older actions may be unavailable, enabling attackers to evade detection, mask data exfiltration, and impede forensic reconstruction and compliance reporting.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks audit_log_retention_period_365_days

Recommendation

Set audit retention to >= 365 days at the tenancy level and protect the setting with least privilege and separation of duties.

Adopt defense in depth: export audit logs to centralized, immutable storage or a SIEM for extended retention, integrity, and continuous monitoring.

Remediation

CLI

oci audit configuration update --compartment-id <tenancy-ocid> --retention-period-days 365

Terraform

resource "oci_audit_configuration" "<example_resource_name>" {
  compartment_id        = var.tenancy_ocid
  retention_period_days = 365 # Critical: sets audit log retention to 365 days to pass the check
}

Other

1Open the OCI Console and go to Governance & Administration > Audit
2Click Configuration
3Set Retention period (days) to 365
4Click Save

Check Code

"""Check Ensure audit log retention period is set to 365 days or greater."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.audit.audit_client import audit_client


class audit_log_retention_period_365_days(Check):
    """Check Ensure audit log retention period is set to 365 days or greater."""

    def execute(self) -> Check_Report_OCI:
        """Execute the audit_log_retention_period_365_days check."""
        findings = []

        # Check audit log retention period
        if audit_client.configuration:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=audit_client.configuration,
                region="global",
                resource_name="Audit Configuration",
                resource_id=audit_client.audited_tenancy,
                compartment_id=audit_client.audited_tenancy,
            )

            if audit_client.configuration.retention_period_days >= 365:
                report.status = "PASS"
                report.status_extended = f"Audit log retention period is {audit_client.configuration.retention_period_days} days (365 days or greater)."
            else:
                report.status = "FAIL"
                report.status_extended = f"Audit log retention period is {audit_client.configuration.retention_period_days} days (less than 365 days)."

            findings.append(report)
        else:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource={},
                region="global",
                resource_name="Audit Configuration",
                resource_id=audit_client.audited_tenancy,
                compartment_id=audit_client.audited_tenancy,
            )
            report.status = "FAIL"
            report.status_extended = "Audit configuration not found."
            findings.append(report)

        return findings

References