Skip to main content

OCI Storage Buckets Should Have Write-Level Logging Enabled

More Info:​

Object Storage buckets should have object-level logging enabled. Logging is critical for monitoring access patterns, investigating potential security incidents, and meeting rigorous compliance auditing requirements.

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • FedRAMP
  • GDPR
  • HIPAA
  • HITRUST CSF
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To enable write‑level logging for OCI Object Storage buckets using the OCI Console:

  1. Sign in & choose compartment

    • Log in to the OCI Console.
    • In the top-left, select the Compartment where the bucket resides (or where you want the log group to live).

  2. Create (or select) a Log Group

    • Open the navigation menu → Observability & Management → Logging → Log Groups.
    • Choose the correct compartment.
    • Either:
      • Select an existing Log Group, or
      • Click Create Log Group, give it a name and (optionally) description, and click Create.

  3. Create a Write‑Level Object Storage Log

    • Within the chosen Log Group, click Create Log.
    • Configure:
      • Log Name: e.g., object-storage-write-logs.
      • Service: select Object Storage.
      • Resource:
        • Choose Bucket, then pick the specific Bucket you want to monitor.
      • Log Category / Log Type: select Write (or Object Storage - Write, depending on UI wording).
    • Leave other options (retention, etc.) as needed for your policy.
    • Click Create (or Enable).

  4. Verify Logging Is Enabled

    • On the bucket details page:
      • Navigate to Storage → Buckets.
      • Open the bucket, then look for Logging or Logs section.
      • Confirm a Write log is attached (or confirm from the Logging → Logs page that the log is Active).
    • Optionally, view recent log entries under Logging → Logs → select your log → Log Explorer to confirm write operations (PUT/DELETE, etc.) are recorded.

  5. Repeat for All Relevant Buckets

    • Repeat steps 3–4 for each bucket that must comply with the requirement.

This configuration satisfies the control “OCI Storage Buckets Should Have Write-Level Logging Enabled” using the OCI Console.

Using CLI

Below is a minimal step‑by‑step using OCI CLI to enable write‑level logging for an Object Storage bucket (i.e., to send write operations to OCI Logging for monitoring).

Assumptions:

  • You already have OCI CLI configured (oci setup config completed).
  • You know the compartment OCID and bucket name.

1. Get the bucket OCID​

# Replace these
COMPARTMENT_OCID="<your_compartment_ocid>"
NAMESPACE=$(oci os ns get --query 'data' --raw-output)
BUCKET_NAME="<your_bucket_name>"

oci os bucket get \
  --name "$BUCKET_NAME" \
  --namespace-name "$NAMESPACE" \
  --query 'data."id"' \
  --raw-output

Save the output as:

BUCKET_OCID="<output_from_previous_command>"

2. Create (or reuse) a Log Group​

If you already have a log group, skip to step 3.

LOG_GROUP_NAME="objectstorage-logs"

oci logging log-group create \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$LOG_GROUP_NAME" \
  --query 'data."id"' \
  --raw-output

Save the output as:

LOG_GROUP_OCID="<output_from_previous_command>"

(If reusing an existing group, get its OCID with oci logging log-group list.)

3. Create a write‑level service log for the bucket​

LOG_NAME="bucket-write-logs-$BUCKET_NAME"

oci logging log create \
  --log-group-id "$LOG_GROUP_OCID" \
  --display-name "$LOG_NAME" \
  --is-enabled true \
  --log-type SERVICE \
  --configuration "{
    \"source\": {
      \"category\": \"write\",
      \"resource\": \"$BUCKET_OCID\",
      \"service\": \"objectstorage\",
      \"sourceType\": \"OCID\"
    }
  }"

This configures a service log for Object Storage with the write category, bound to the specific bucket OCID.

4. Verify the log is enabled​

oci logging log list \
  --log-group-id "$LOG_GROUP_OCID" \
  --query "data[?\"display-name\"=='$LOG_NAME']"

You should see "is-enabled": true and "configuration.source.category": "write".

That’s all that is required to remediate: the bucket now has write‑level logging enabled via OCI Logging, using OCI CLI.

Using Python

Below is a minimal, end‑to‑end way to enable write‑level (DATA_WRITE) logging for an OCI Object Storage bucket using Python and the OCI SDK.

1. Prerequisites​

  1. Install OCI SDK:
pip install oci

  1. Configure your OCI credentials (tenancy, user, key, region, etc.) via:

    • ~/.oci/config (default profile), or
    • Environment variables / instance principal / resource principal.

  2. Collect:

    • Compartment OCID where the bucket lives.
    • Bucket OCID (not just name). You can get this via Console or SDK:
      • In the Console: Object Storage → Bucket → Bucket details → OCID.

2. Get or Create a Log Group​

You need a Log Group in the same compartment to hold the bucket logs.

import oci

config = oci.config.from_file()  # or from_file("~/.oci/config", "PROFILE_NAME")

logging_mgmt_client = oci.logging.LoggingManagementClient(config)

compartment_id = "ocid1.compartment.oc1..xxxx"  # your compartment OCID

# Option 1: find existing log group (by name, tag, etc.)
def get_log_group(logging_mgmt_client, compartment_id, display_name):
    log_groups = oci.pagination.list_call_get_all_results(
        logging_mgmt_client.list_log_groups,
        compartment_id=compartment_id
    ).data
    for lg in log_groups:
        if lg.display_name == display_name:
            return lg
    return None

log_group_display_name = "objectstorage-logs"
log_group = get_log_group(logging_mgmt_client, compartment_id, log_group_display_name)

# Option 2: create one if it doesn’t exist
if log_group is None:
    create_lg_details = oci.logging.models.CreateLogGroupDetails(
        compartment_id=compartment_id,
        display_name=log_group_display_name,
        description="Log group for Object Storage bucket write logs"
    )
    log_group = logging_mgmt_client.create_log_group(create_lg_details).data

log_group_id = log_group.id

3. Create/Enable a Write‑Level Log for the Bucket​

In the Logging service, Object Storage has categories such as write and read.
To satisfy “write‑level logging”, you must enable the write category for the bucket.

bucket_ocid = "ocid1.bucket.oc1..xxxx"  # your bucket OCID

# Check if a log already exists for this bucket + write category
def find_bucket_write_log(logging_mgmt_client, log_group_id, bucket_ocid):
    logs = oci.pagination.list_call_get_all_results(
        logging_mgmt_client.list_logs,
        log_group_id=log_group_id
    ).data

    for log in logs:
        src = log.configuration.source
        if (
            log.lifecycle_state == "ACTIVE"
            and src.service == "objectstorage"
            and src.resource == bucket_ocid
            and src.category == "write"
        ):
            return log
    return None

existing_log = find_bucket_write_log(logging_mgmt_client, log_group_id, bucket_ocid)

if existing_log:
    # Ensure it is enabled
    if not existing_log.is_enabled:
        update_details = oci.logging.models.UpdateLogDetails(
            is_enabled=True
        )
        logging_mgmt_client.update_log(
            log_group_id=log_group_id,
            log_id=existing_log.id,
            update_log_details=update_details
        )
    print(f"Write-level logging already enabled for bucket {bucket_ocid}")
else:
    # Create new SERVICE log for Object Storage write operations
    create_log_details = oci.logging.models.CreateLogDetails(
        display_name="bucket-write-log",
        log_type="SERVICE",
        is_enabled=True,
        configuration=oci.logging.models.LogConfiguration(
            source=oci.logging.models.LogSource(
                service="objectstorage",
                category="write",      # write-level
                resource=bucket_ocid,  # bucket OCID
                source_type="OCISERVICE"
            )
        ),
        # optional: tags, retention, etc.
        # retention_duration=30   # days
    )

    new_log = logging_mgmt_client.create_log(
        log_group_id=log_group_id,
        create_log_details=create_log_details
    ).data

    print(f"Enabled write-level logging for bucket {bucket_ocid} in log group {log_group_id}")

4. (Optional) Send Logs to Monitoring / Metrics​

If by “Storage Monitoring” you also want metrics or alarms:

  1. Create a Service Connector (Console or SDK) with:
    • Source: Logging (your log group/log).
    • Target: Monitoring / Logging Analytics / Object Storage.
  2. Build Monitoring queries/alarms on those logs/derived metrics.

That part depends on your specific monitoring design, but is separate from enabling write‑level logging, which the above Python code accomplishes.

Using Terraform
# Existing bucket (example)
resource "oci_objectstorage_bucket" "TARGET_BUCKET" {
  compartment_id = "OCID_OF_BUCKET_COMPARTMENT"
  name           = "BUCKET_NAME"
  namespace      = "OBJECTSTORAGE_NAMESPACE"

  # ...other existing arguments...
}

# Log group to hold Object Storage logs
resource "oci_logging_log_group" "OBJECTSTORAGE_LOG_GROUP" {
  compartment_id = oci_objectstorage_bucket.TARGET_BUCKET.compartment_id
  display_name   = "OBJECTSTORAGE_WRITE_LOG_GROUP"
  description    = "Log group for Object Storage write-level logs"
}

# Enable write-level (object-level) logging for the bucket
resource "oci_logging_log" "OBJECTSTORAGE_WRITE_LOG" {
  display_name = "OBJECTSTORAGE_WRITE_LOG"
  log_group_id = oci_logging_log_group.OBJECTSTORAGE_LOG_GROUP.id

  # Log type "SERVICE" enables OCI service logs
  log_type = "SERVICE"

  is_enabled = true

  configuration {
    source {
      # Service name for Object Storage
      service  = "objectstorage"

      # Category "write" enables write-level logging
      category = "write"

      # Target bucket OCID for which to capture write events
      resource = oci_objectstorage_bucket.TARGET_BUCKET.id
    }
  }
}

This change does not force replacement of the existing bucket; it adds separate logging resources.

Verification: terraform plan should show + (create) for oci_logging_log_group.OBJECTSTORAGE_LOG_GROUP and oci_logging_log.OBJECTSTORAGE_WRITE_LOG, with is_enabled = true, service = "objectstorage", category = "write", and resource set to the bucket OCID.