Skip to main content

OCI Logging Logs Should Be Encrypted With KMS Keys

More Info:​

Log data should be encrypted with customer-managed KMS keys. Encrypting logs protects sensitive information from unauthorized access if storage is compromised.

Risk Level​

High

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • GDPR
  • HIPAA
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Below are the console-based steps to ensure OCI Logging (including Monitoring logs) is encrypted with a customer-managed KMS key.

1. Create / Identify a Vault and KMS Key​

  1. In the OCI Console, open the navigation menu.
  2. Go to Governance & Administration → Security → Vault.
  3. Choose the compartment where you want the key to live.
  4. If you don’t have a vault yet:
    • Click Create vault.
    • Give it a name, select Type: Default (or as required), and Create.
    • Wait until the vault is Active.
  5. Open the vault.
  6. Go to the Master Encryption Keys tab.
  7. Click Create key:
    • Key type: Encrypt/Decrypt
    • Name and description as needed (e.g., logging-monitoring-key).
    • Protection mode: HSM (typical) or as per your standards.
    • Click Create key.

2. Add IAM Policies So Logging Can Use the Key​

  1. Go to Identity & Security → Policies.

  2. Choose the compartment where you want to define the policy (often tenancy root or the compartment of the logs).

  3. Click Create Policy (or edit an existing one).

  4. Add statements like (adjust compartment/tenancy as needed):

    Allow service logging to use keys in tenancy
    Allow service loganalytics to use keys in tenancy

    Or limit to a specific compartment:

    Allow service logging to use keys in compartment <compartment-name>
    Allow service loganalytics to use keys in compartment <compartment-name>

  5. Save the policy.

3. Configure Log Group Encryption With Your KMS Key​

Monitoring service logs are stored in Log Groups in OCI Logging, and encryption is set at the log group level.

  1. Go to Observability & Management → Logging → Log Groups.

  2. In the left, select the compartment where your Monitoring logs’ Log Group resides (or where you will create it).

  3. Either:

    • Use existing Log Group that contains Monitoring logs, or
    • Click Create log group (e.g., name: monitoring-logs-group) to isolate Monitoring logs.

  4. Select the log group.

  5. In the log group details page, find Encryption (or Encryption Key).

  6. Click Edit / Update:

    • Choose Encrypt using Customer-Managed Key (CMK).
    • Select the Vault and then the Key you created earlier.
    • Save / Update.

From this point on, new log entries in that log group will be encrypted with the KMS key.

4. Ensure Monitoring Is Sending Logs to That Encrypted Log Group​

  1. Go to Observability & Management → Logging → Logs.
  2. Filter by the compartment and Log Group you just configured.
  3. For each Monitoring log (e.g., service logs or custom logs from Monitoring):
    • Ensure the Log Group selected is the one encrypted with your CMK.
    • If needed, recreate or modify the log to use that encrypted log group.

5. Re-check Compliance​

  • Verify in Log Group Details that Encryption shows your Customer-Managed Key.
  • Confirm Monitoring logs you care about are in that log group.

Note: Existing log data written before enabling CMK encryption is not re-encrypted; only new data is written under the KMS key.

Using CLI

Below is how to remediate “OCI Logging Logs Should Be Encrypted With KMS Keys” for Logging (including Monitoring service logs) using the OCI CLI.

The key point: encryption is configured on the Log Group, not per individual log. So you must attach a KMS key to the log group that contains your Monitoring logs.

1. Prerequisites​

  1. OCI CLI installed and configured (oci setup config done).
  2. You know:
    • Your tenancy OCID
    • Target compartment OCID where the log group lives
  3. You have permission to:
    • Use / manage KMS keys
    • Manage Log Groups

2. Create or Identify a KMS Key​

If you already have an appropriate KMS key, skip to step 3.

2.1. Find the KMS Vault​

oci kms management vault list \
  --compartment-id <COMPARTMENT_OCID>

Pick a vault OCID from the output: ocid1.vault.oc1...

2.2. Create a New KMS Key​

oci kms management key create \
  --compartment-id <COMPARTMENT_OCID> \
  --display-name "logging-encryption-key" \
  --vault-id <VAULT_OCID> \
  --protection-mode HSM

From the output, capture the id field → this is your KMS key OCID: <KMS_KEY_OCID>

3. Ensure KMS Key Policy Allows Logging Service​

Get the current key policy:

oci kms management key get \
  --key-id <KMS_KEY_OCID> \
  --endpoint <KMS_MANAGEMENT_ENDPOINT> \
  --query 'data."policy"' \
  --raw-output

<KMS_MANAGEMENT_ENDPOINT> looks like: https://management.kms.<region>.oraclecloud.com

Your key policy must allow the Logging service principal, for example:

{
  "resources": [
    "key"
  ],
  "statements": [
    {
      "actions": [
        "USE"
      ],
      "principal": [
        "logging"
      ],
      "effect": "ALLOW"
    }
  ]
}

If you need to update it, put the JSON into a file key_policy.json and run:

oci kms management key update \
  --key-id <KMS_KEY_OCID> \
  --endpoint <KMS_MANAGEMENT_ENDPOINT> \
  --policy file://key_policy.json

4. Find the Log Group for Monitoring Logs​

List log groups in the compartment:

oci logging log-group list \
  --compartment-id <COMPARTMENT_OCID>

Identify the log group that contains your Monitoring service logs (often by display-name).

Capture its OCID: <LOG_GROUP_OCID>

If you’re unsure which log group:

oci logging log list \
  --log-group-id <LOG_GROUP_OCID>

Look for logs where:

  • source-service or display-name clearly indicate Monitoring.

5. Attach the KMS Key to the Log Group​

Update the log group to use your KMS key:

oci logging log-group update \
  --log-group-id <LOG_GROUP_OCID> \
  --kms-key-id <KMS_KEY_OCID>

This sets the KMS key for all logs in that log group (including Monitoring service logs).

6. Verify Encryption Is Using KMS Key​

Describe the log group:

oci logging log-group get \
  --log-group-id <LOG_GROUP_OCID> \
  --query 'data."kms-key-id"' \
  --raw-output

Expected output: your <KMS_KEY_OCID> (not empty or null).

Optional: verify a specific Monitoring log is in that group:

oci logging log list \
  --log-group-id <LOG_GROUP_OCID> \
  --query 'data[].{"Name": "display-name", "Service": "source-service"}'

7. Apply to All Relevant Log Groups​

Repeat steps 4–6 for each log group that holds logs you want encrypted with KMS (not just Monitoring).

If you’d like, I can help you craft a small shell script to automatically attach the same KMS key to all log groups in a compartment.

Using Python

To encrypt OCI Logging logs (including Monitoring service logs) with a customer-managed KMS key using Python, you need to:

  1. Create or identify a KMS key
  2. Update the relevant Log Group(s) to use that KMS key

Below is a minimal step‑by‑step guide with Python code.

1. Prerequisites​

  • OCI Python SDK installed: 
    pip install oci
  • A config file at ~/.oci/config (or equivalent) with:
    • tenancy, user, fingerprint, key_file, region, etc.
  • OCIDs you need:
    • log_group_id (for the log group where Monitoring logs are stored)
    • kms_key_id (OCID of the KMS key you want to use)

If you don’t yet have a KMS key:

import oci

config = oci.config.from_file("~/.oci/config")
kms_management_client = oci.key_management.KmsManagementClient(config)

# Example: create a key in an existing Vault
create_key_details = oci.key_management.models.CreateKeyDetails(
    compartment_id="<COMPARTMENT_OCID>",
    display_name="logging-kms-key",
    key_shape=oci.key_management.models.KeyShape(algorithm="AES", length=32),
    protection_mode="HSM"  # or "SOFTWARE" depending on your config
)
key = kms_management_client.create_key(create_key_details).data
print("KMS key OCID:", key.id)

Use the printed key.id as kms_key_id below.

2. Update an Existing Log Group to Use the KMS Key​

Encrypting logs in OCI Logging is done at the log group level by setting the kmsKeyId on the log group.

import oci

# Load config
config = oci.config.from_file("~/.oci/config")  # adjust path/PROFILE as needed
logging_client = oci.logging.LoggingManagementClient(config)

log_group_id = "<LOG_GROUP_OCID>"  # The log group that holds your Monitoring logs
kms_key_id   = "<KMS_KEY_OCID>"    # The customer-managed KMS key

# Get the existing log group
existing_log_group = logging_client.get_log_group(log_group_id).data

# Prepare update details – only kms_key_id is required for encryption change
update_details = oci.logging.models.UpdateLogGroupDetails(
    description=existing_log_group.description,
    display_name=existing_log_group.display_name,
    defined_tags=existing_log_group.defined_tags,
    freeform_tags=existing_log_group.freeform_tags,
    kms_key_id=kms_key_id     # <- This is the key field to enable CMEK encryption
)

# Update the log group
response = logging_client.update_log_group(
    log_group_id=log_group_id,
    update_log_group_details=update_details
)

print("Updated log group KMS key:", response.data.kms_key_id)

Once this is applied:

  • All new data written to logs in this log group (including Monitoring service logs routed there) will be encrypted with the specified KMS key.
  • Existing encrypted data (if any) remains under its previous key; OCI does not retroactively re-encrypt old data.

3. Verifying​

Use the SDK or Console to confirm:

result = logging_client.get_log_group(log_group_id).data
print("Current KMS key on log group:", result.kms_key_id)

If this prints the kms_key_id you set, the log group is now using a customer-managed KMS key for encryption.

Using Terraform
# Log Group for Monitoring service logs, encrypted with a customer-managed KMS key
resource "oci_logging_log_group" "monitoring_logs" {
  compartment_id = var.COMPARTMENT_OCID          # Replace with the OCID of the compartment
  display_name   = "monitoring-log-group"

  # Use a customer-managed KMS key for log encryption
  kms_key_id = var.KMS_KEY_OCID                  # Replace with the OCID of your KMS key
}

# Example: a Monitoring service log in this log group (optional context)
resource "oci_logging_log" "monitoring_service_log" {
  display_name = "monitoring-service-log"

  compartment_id = var.COMPARTMENT_OCID
  log_group_id   = oci_logging_log_group.monitoring_logs.id
  log_type       = "SERVICE"

  configuration {
    source {
      category    = "oci_monitoring"             # Example Monitoring category
      resource    = var.MONITORING_RESOURCE_OCID # Replace with the monitored resource OCID if needed
      service     = "monitoring"
      source_type = "OCISERVICE"
    }
  }

  is_enabled = true
}

Changing or adding kms_key_id on oci_logging_log_group is an in-place update and does not force replacement of the log group.

To verify, terraform plan should show an update to the existing oci_logging_log_group with kms_key_id changing from null (or the old key OCID) to the specified var.KMS_KEY_OCID.