> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Bucket lock on log buckets remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, I can help you with that. Here are the step-by-step instructions to remediate the misconfiguration "Log Buckets Should Have Retention Policies" in GCP using the GCP console:

        1. Open the GCP Console in your web browser and log in to your account.
        2. Navigate to the Cloud Storage section by clicking on the hamburger menu (☰) in the top-left corner of the console, then selecting "Storage" and "Browser" from the dropdown menu.
        3. Locate the log bucket that needs to have a retention policy added.
        4. Click on the name of the bucket to open its details page.
        5. Click on the "Edit bucket retention" button located in the "Bucket metadata" section.
        6. In the "Retention period" section, select the desired retention period for the logs. You can choose a custom period or select from the predefined options.
        7. Click on the "Save" button to apply the retention policy to the bucket.

        Once you have completed these steps, the log bucket will have a retention policy applied to it, which will help ensure that logs are retained for the appropriate amount of time.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the issue of log buckets not having retention policies in GCP using GCP CLI, follow the below steps:

        1. Open the Cloud Shell in the GCP console.
        2. Run the command `gsutil retention set <retention_period> gs://<bucket_name>` to set the retention policy for the log bucket. Replace `<retention_period>` with the desired retention period in seconds, and `<bucket_name>` with the name of the log bucket.
        3. Run the command `gsutil retention get gs://<bucket_name>` to confirm that the retention policy has been set for the log bucket. Replace `<bucket_name>` with the name of the log bucket.

        Note: Retention policies are irreversible and cannot be removed once set. Be sure to set the retention policy carefully.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of log buckets not having retention policies in GCP using Python, follow these steps:

        1. First, you need to authenticate to GCP using the Google Cloud SDK. You can install the SDK using this link: [https://cloud.google.com/sdk/docs/install](https://cloud.google.com/sdk/docs/install)

        2. Once you have installed the SDK, run the following command to authenticate:

           ```
           gcloud auth login
           ```

        3. Next, you need to install the Google Cloud Storage Python library. You can install it using the following command:

           ```
           pip install google-cloud-storage
           ```

        4. After installing the library, you can use the following Python code to set a retention policy on a log bucket:

           ```python theme={null}
           from google.cloud import storage

           # Set the name of the log bucket
           bucket_name = 'your-bucket-name'

           # Set the retention period in seconds (e.g. 7 days)
           retention_period = 604800

           # Authenticate to GCP
           client = storage.Client()

           # Get the bucket
           bucket = client.get_bucket(bucket_name)

           # Set the retention policy
           bucket.retention_period = retention_period
           bucket.patch()
           ```

        5. Replace `your-bucket-name` with the name of the log bucket you want to set the retention policy on.

        6. Replace `retention_period` with the desired retention period in seconds. For example, 604800 seconds is equivalent to 7 days.

        7. Save the code to a Python file and run it using the following command:

           ```
           python your-file-name.py
           ```

        8. Verify that the retention policy has been set by checking the bucket's properties in the GCP console.

        By following these steps, you can remediate the misconfiguration of log buckets not having retention policies in GCP using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Cloud Logging bucket with a Bucket Lock–backed retention policy.
        # Replace PLACEHOLDERS with your own values.

        resource "google_logging_project_bucket_config" "LOG_BUCKET" {
          project        = "PROJECT_ID"              # e.g. "my-project"
          location       = "LOG_LOCATION"            # e.g. "global" or "us-central1"
          bucket_id      = "LOG_BUCKET_ID"           # e.g. "_Default" or "my-log-bucket"

          # Configure retention using Bucket Locks semantics
          retention_days = 365                       # set to the required threshold
          locked         = true                      # enables Bucket Lock (irreversible)
        }

        # Logging sink that routes logs into the locked log bucket.
        resource "google_logging_project_sink" "LOG_SINK" {
          project = "PROJECT_ID"
          name    = "LOG_SINK_NAME"

          # IMPORTANT: the sink only points to the bucket; it does not control retention.
          destination = "logging.googleapis.com/projects/PROJECT_ID/locations/LOG_LOCATION/buckets/LOG_BUCKET_ID"

          filter                  = "LOG_FILTER_EXPRESSION" # optional
          unique_writer_identity  = true

          # Optional bigquery or other options here...
        }

        ```

        Changing `locked` from `false` to `true` is irreversible in Google Cloud (you will not be able to shorten or remove the retention period afterward), but it does not force Terraform to replace the bucket resource; it updates the existing bucket in place and then GCP forbids future unlocks.

        Verification with `terraform plan` should show an in-place update (or creation) of `google_logging_project_bucket_config.LOG_BUCKET` adding/updating `retention_days` to your threshold and `locked = true`, with no other unrelated changes.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>