Back to Checks
oraclecloud

Object Storage bucket has write-level logging enabled

objectstorage_bucket_logging_enabled
Service: objectstorageSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:Bucket

OCI Object Storage buckets have service logs for write access events enabled.

The evaluation identifies buckets with an active write logging category scoped to the bucket and region; only read logging does not satisfy this condition.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without write logging, unauthorized or accidental overwrites and deletions can go undetected, degrading data integrity and availability.

Missing audit evidence weakens non-repudiation, impedes incident response, and allows covert tampering without reliable forensic reconstruction.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks objectstorage_bucket_logging_enabled

Recommendation

Enable write service logs on all buckets and route them to a centralized log group for monitoring.

Apply least privilege to log data, enforce retention and immutability, and alert on anomalous write activity. Use defense in depth so bucket changes are accountable and swiftly detected.

Remediation

CLI

oci logging log create --log-group-id <log-group-ocid> --display-name ObjectStorage-Write-Logs --log-type SERVICE --configuration '{"compartmentId":"<compartment-ocid>","source":{"service":"objectstorage","resource":"<bucket-name>","category":"write","sourceType":"OCISERVICE"}}'

Terraform

resource "oci_logging_log" "<example_resource_name>" {
  display_name = "ObjectStorage-Write-Logs"
  log_group_id = "<example_resource_id>"
  log_type     = "SERVICE"

  configuration {
    compartment_id = "<example_resource_id>"
    source {
      service     = "objectstorage"          # Critical: Service must be Object Storage
      category    = "write"                   # Critical: Enable write-level logging
      resource    = "<example_resource_name>" # Critical: Bucket name must match the target bucket
      source_type = "OCISERVICE"
    }
  }
}

Other

1In the OCI Console, select the target region and go to Observability & Management > Logging > Log groups
2Open an existing log group or click Create log group
3Click Create log
4Type: Service
5Service: Object Storage
6Category: write
7Resource: select the target bucket (bucket name must match)
8Ensure Enabled is checked
9Click Create

Check Code

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.logging.logging_client import logging_client
from prowler.providers.oraclecloud.services.objectstorage.objectstorage_client import (
    objectstorage_client,
)


class objectstorage_bucket_logging_enabled(Check):
    """Ensure write level Object Storage logging is enabled for all buckets"""

    def execute(self):
        """Execute check to verify write-level logging is enabled for Object Storage buckets."""
        findings = []

        for bucket in objectstorage_client.buckets:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=bucket,
                region=bucket.region,
                resource_id=bucket.id,
                resource_name=bucket.name,
                compartment_id=bucket.compartment_id,
            )

            # Check if there is a write-level log configured for this bucket
            # A write log should have:
            # - source.service == 'objectstorage'
            # - source.category == 'write'
            # - source.resource == bucket.name
            has_write_logging = False
            has_read_logging = False
            for log in logging_client.logs:
                if (
                    log.source_service == "objectstorage"
                    and log.source_category == "write"
                    and log.source_resource == bucket.name
                    and log.region == bucket.region
                    and log.is_enabled
                ):
                    has_write_logging = True
                elif (
                    log.source_service == "objectstorage"
                    and log.source_category == "read"
                    and log.source_resource == bucket.name
                    and log.region == bucket.region
                    and log.is_enabled
                ):
                    has_read_logging = True

            if has_write_logging:
                report.status = "PASS"
                report.status_extended = (
                    f"Bucket {bucket.name} has write-level logging enabled."
                )
            elif has_read_logging:
                report.status = "FAIL"
                report.status_extended = (
                    f"Bucket {bucket.name} has read-level logging enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Bucket {bucket.name} does not have write-level logging enabled."
                )

            findings.append(report)

        return findings

References