OCI Logging Audit Should Be Enabled

More Info:

OCI Audit service should be enabled to capture all API calls and events. Audit logs are essential for security investigations, compliance reporting, and detecting unauthorized activity

Risk Level

Medium

Address

Compliance, Security

Compliance Standards

APRA CPS 234 (Australia)
AWS Startup Security Baseline
AWS Well Architected Framework
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS AWS
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
FedRAMP
GDPR
HIPAA
ISO 27001
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST
NIST CSF
NIST SP 800-171
NYDFS 23 NYCRR 500
PCI
Reserve Bank of India (RBI) Cyber Security Framework
Reserve Bank of India (RBI) Master Direction – Information Technology Framework
SOC2
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Below are the exact console steps to enable OCI Audit logs in Logging (the usual remediation for “OCI Logging Audit Should Be Enabled” using the OCI Console):

1. Open Logging in the correct compartment

Sign in to the OCI Console.
At the top, select the correct Region.
In the left menu, go to:
Observability & Management → Logging → Log groups.
In the upper-left compartment selector, choose the compartment where you want to store the Audit logs (commonly the root compartment or a central logging compartment).

2. Create (or choose) a Log Group

If you don’t already have a log group for audit logs, click Create log group.
Enter:
- Name (e.g., audit-log-group)
- Description (optional)
- Confirm the Compartment.
Click Create.

(If you already have a log group, you can reuse it and skip creating a new one.)

3. Enable the Audit service log

In the same compartment, go to:
Observability & Management → Logging → Logs.
Click Enable service log.
Fill in:
- Compartment: the compartment whose Audit events you want to log.
- Service: select Audit.
- Resource: choose tenancy or the specific resource scope (commonly the tenancy).
- Log category: usually Audit (or the default shown).
- Log group: select the log group created above (e.g., audit-log-group).
- Name: e.g., audit-log.
Confirm State is set to Enabled.
Click Enable log.

Audit events for that compartment/tenancy are now written into the selected log group.

4. (Optional) Send Audit logs to Monitoring / Alarms

If “for Logging Monitoring” means you want alerts based on Audit logs:

Create a Service Connector:
Observability & Management → Service Connectors → Create service connector.
- Source: Logging
- Source log group: the log group with your Audit log
- (Optionally filter for specific log content)
- Target: Logging or Streaming (then you can feed into Functions, custom processing, etc.).
Create Alarms in Monitoring → Alarms using metrics/logs produced by your processing pipeline, as applicable to your architecture.

For the basic “OCI Logging Audit Should Be Enabled” requirement, steps 1–3 are sufficient.

Using CLI

In OCI, Audit is always on, but “Logging Audit should be enabled” usually means:

Create a Log Group
Create an Audit Log in that Log Group using the Logging service
(all via OCI CLI).

Below are step‑by‑step CLI commands.

0. Prerequisites

OCI CLI installed and configured (~/.oci/config with tenancy, user, key, region).
You have permission: manage log-groups and manage logs in the target compartment (often the root compartment).

1. Identify the Compartment

Typically you enable Audit logging in the root compartment of the tenancy.

If you already know the compartment OCID, skip to step 2.
Otherwise, list compartments:

oci iam compartment list \
  --all \
  --compartment-id-in-subtree true \
  --access-level ANY

Find the compartment OCID you want to use (e.g., the root compartment).

Assume:

COMPARTMENT_OCID="<your_compartment_ocid_here>"

2. Create a Log Group (if you don’t already have one)

LOG_GROUP_NAME="audit-log-group"
LOG_GROUP_DESC="Log group for Audit logs"

oci logging log-group create \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$LOG_GROUP_NAME" \
  --description "$LOG_GROUP_DESC" \
  --query "data.id" \
  --raw-output

This outputs the Log Group OCID. Save it:

LOG_GROUP_OCID="<output_from_previous_command>"

If you already have a log group, you can get its OCID with:

oci logging log-group list \
  --compartment-id "$COMPARTMENT_OCID"

3. Create an Audit Log in the Log Group

Create a log that captures Audit service events:

LOG_NAME="audit-log"

oci logging log create \
  --log-group-id "$LOG_GROUP_OCID" \
  --display-name "$LOG_NAME" \
  --log-type SERVICE \
  --is-enabled true \
  --configuration '{
    "source": {
      "category": "audit",
      "service": "audit",
      "resource": "audit"
    }
  }' \
  --query "data.id" \
  --raw-output

This command:

--log-type SERVICE → tells Logging to collect from an OCI service.
category: "audit" and service: "audit" → specifically select Audit logs.
--is-enabled true → enables the log immediately.

4. Verify the Log Is Enabled

oci logging log get \
  --log-id "<log_ocid_from_previous_command>"

Check that:

"is-enabled": true
"logType": "SERVICE"
configuration.source.service is "audit"
configuration.source.category is "audit"

5. (Optional) Enable Logs via Existing Log Group Only

If you just want to ensure any existing Audit log is enabled:

List logs in the log group:

oci logging log list \
  --log-group-id "$LOG_GROUP_OCID"

For any Audit log you find, enable it:

oci logging log update \
  --log-id "<existing_audit_log_ocid>" \
  --is-enabled true

These steps enable OCI Logging for Audit events via the OCI CLI, which satisfies “OCI Logging Audit Should Be Enabled” for monitoring and compliance.

Using Python

To enable OCI Audit logs (and similarly Monitoring service logs) via Python, you use the OCI Python SDK and the LoggingManagementClient to create a log in a log group.

Below is a minimal, step‑by‑step approach.

1. Prerequisites

Install OCI SDK:

pip install oci

Ensure you have a valid OCI config file, usually at ~/.oci/config, with:

Tenancy OCID
User OCID
Fingerprint
Private key path
Region

IAM policies (attached to a group your user/API key belongs to), for example:

Allow group <your_group> to manage log-groups in tenancy
Allow group <your_group> to manage logs in tenancy
Allow service loganalytics to use log-content in tenancy     # if you use Log Analytics

2. Enable Audit Logging in OCI Logging (Python)

This creates (if needed) a log group and an Audit log in the root compartment.

import oci

# --- CONFIGURE AUTH & CLIENTS ---
config = oci.config.from_file("~/.oci/config", "DEFAULT")
tenancy_ocid = config["tenancy"]

logging_client = oci.logging.LoggingManagementClient(config)

# --- PARAMETERS YOU CAN ADJUST ---
log_group_display_name = "Tenant-Audit-Logs"
audit_log_display_name = "Audit-Log"

# 1. Find or create a log group in the tenancy (root compartment)
def get_or_create_log_group(compartment_id, display_name):
    # Check if log group already exists
    list_resp = logging_client.list_log_groups(
        compartment_id=compartment_id,
        display_name=display_name
    )
    if list_resp.data:
        return list_resp.data[0]

    # Create log group
    create_details = oci.logging.models.CreateLogGroupDetails(
        compartment_id=compartment_id,
        display_name=display_name,
        description="Log group for Audit logs"
    )
    create_resp = logging_client.create_log_group(create_details)
    return create_resp.data

log_group = get_or_create_log_group(tenancy_ocid, log_group_display_name)

# 2. Check if Audit log already exists
def log_exists(log_group_id, display_name):
    logs = logging_client.list_logs(
        log_group_id=log_group_id,
        display_name=display_name
    ).data
    return logs[0] if logs else None

existing_audit_log = log_exists(log_group.id, audit_log_display_name)
if existing_audit_log:
    print(f"Audit log already enabled: {existing_audit_log.id}")
else:
    # 3. Create Audit log
    create_log_details = oci.logging.models.CreateLogDetails(
        display_name=audit_log_display_name,
        log_type="SERVICE",
        is_enabled=True,
        # Audit source configuration
        configuration=oci.logging.models.Configuration(
            source=oci.logging.models.ServiceLogsSource(
                category="audit",            # Audit category
                resource="audit",            # Resource type for Audit
                service="audit"              # Service name for Audit
            )
        ),
        retention_duration=30  # days, adjust as needed
    )

    resp = logging_client.create_log(
        log_group_id=log_group.id,
        create_log_details=create_log_details
    )
    print(f"Created Audit log: {resp.data.id}")

This script:

Ensures a log group exists in the root compartment.
Creates an enabled Audit log that sends Audit events to the Logging service.

3. Enabling Monitoring Service Logs in the Same Way

To remediate “OCI Logging Monitoring” (e.g., enabling logs for the Monitoring service), you create another SERVICE log in the same or a different log group, changing only the source details.

Example:

monitoring_log_display_name = "Monitoring-Write-Logs"

existing_monitoring_log = log_exists(log_group.id, monitoring_log_display_name)
if existing_monitoring_log:
    print(f"Monitoring log already enabled: {existing_monitoring_log.id}")
else:
    create_monitoring_log_details = oci.logging.models.CreateLogDetails(
        display_name=monitoring_log_display_name,
        log_type="SERVICE",
        is_enabled=True,
        configuration=oci.logging.models.Configuration(
            source=oci.logging.models.ServiceLogsSource(
                # Check your tenancy's available categories with the SDK or Console;
                # common ones for Monitoring are "read", "write", or "readwrite".
                category="write",
                resource="alarms",      # or relevant Monitoring resource
                service="monitoring"
            )
        ),
        retention_duration=30  # days
    )

    resp = logging_client.create_log(
        log_group_id=log_group.id,
        create_log_details=create_monitoring_log_details
    )
    print(f"Created Monitoring log: {resp.data.id}")

4. Applying Across Compartments (Optional)

If your requirement is “Audit Logging must be enabled everywhere,” you can:

Use IdentityClient.list_compartments with compartment_id_in_subtree=True.
Loop through compartments and:
- Create/find a log group per compartment.
- Create an Audit log (and Monitoring log) in each.

If you want that loop example as well, ask and I’ll provide a compact script for all compartments.

Using Terraform

resource "oci_logging_log_group" "audit_log_group" {
  # Replace with your tenancy or target compartment OCID
  compartment_id = "OCID_OF_TARGET_COMPARTMENT"
  display_name   = "audit-log-group"
  description    = "Log group for Audit service logs"
}

resource "oci_logging_log" "audit_log" {
  log_group_id = oci_logging_log_group.audit_log_group.id
  display_name = "audit-log"

  # Enable Audit service logging
  is_enabled = true
  log_type   = "SERVICE"

  configuration {
    source {
      # Audit service as the source
      category    = "audit"
      resource    = "audit"
      service     = "audit"
      source_type = "OCISERVICE"
    }

    compartment_id = "OCID_OF_TARGET_COMPARTMENT" # same as above or a specific compartment for the logs
  }

  retention_duration = 30 # DAYS; adjust to your policy
}

Substitute:

OCID_OF_TARGET_COMPARTMENT with the OCID of the compartment where you want to store the audit logs.

This change does not replace existing OCI resources; it only creates/updates logging resources to capture Audit events.

To verify, terraform plan should show creation (or update) of:

oci_logging_log_group.audit_log_group
oci_logging_log.audit_log with is_enabled = true, log_type = "SERVICE", and service = "audit".

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

1. Open Logging in the correct compartment​

2. Create (or choose) a Log Group​

3. Enable the Audit service log​

4. (Optional) Send Audit logs to Monitoring / Alarms​

0. Prerequisites​

1. Identify the Compartment​

2. Create a Log Group (if you don’t already have one)​

3. Create an Audit Log in the Log Group​

4. Verify the Log Is Enabled​

5. (Optional) Enable Logs via Existing Log Group Only​

1. Prerequisites​

2. Enable Audit Logging in OCI Logging (Python)​

3. Enabling Monitoring Service Logs in the Same Way​

4. Applying Across Compartments (Optional)​