OCI Logging Logs Should Be Encrypted With KMS Keys

Using Console

Below are the console-based steps to ensure OCI Logging (including Monitoring logs) is encrypted with a customer-managed KMS key.

1. Create / Identify a Vault and KMS Key

In the OCI Console, open the navigation menu.
Go to Governance & Administration → Security → Vault.
Choose the compartment where you want the key to live.
If you don’t have a vault yet:
- Click Create vault.
- Give it a name, select Type: Default (or as required), and Create.
- Wait until the vault is Active.
Open the vault.
Go to the Master Encryption Keys tab.
Click Create key:
- Key type: Encrypt/Decrypt
- Name and description as needed (e.g., logging-monitoring-key).
- Protection mode: HSM (typical) or as per your standards.
- Click Create key.

2. Add IAM Policies So Logging Can Use the Key

Go to Identity & Security → Policies.
Choose the compartment where you want to define the policy (often tenancy root or the compartment of the logs).
Click Create Policy (or edit an existing one).

Add statements like (adjust compartment/tenancy as needed):

Allow service logging to use keys in tenancy
Allow service loganalytics to use keys in tenancy

Or limit to a specific compartment:

Allow service logging to use keys in compartment <compartment-name>
Allow service loganalytics to use keys in compartment <compartment-name>

Save the policy.

3. Configure Log Group Encryption With Your KMS Key

Monitoring service logs are stored in Log Groups in OCI Logging, and encryption is set at the log group level.

Go to Observability & Management → Logging → Log Groups.
In the left, select the compartment where your Monitoring logs’ Log Group resides (or where you will create it).
Either:
- Use existing Log Group that contains Monitoring logs, or
- Click Create log group (e.g., name: monitoring-logs-group) to isolate Monitoring logs.
Select the log group.
In the log group details page, find Encryption (or Encryption Key).
Click Edit / Update:
- Choose Encrypt using Customer-Managed Key (CMK).
- Select the Vault and then the Key you created earlier.
- Save / Update.

From this point on, new log entries in that log group will be encrypted with the KMS key.

4. Ensure Monitoring Is Sending Logs to That Encrypted Log Group

Go to Observability & Management → Logging → Logs.
Filter by the compartment and Log Group you just configured.
For each Monitoring log (e.g., service logs or custom logs from Monitoring):
- Ensure the Log Group selected is the one encrypted with your CMK.
- If needed, recreate or modify the log to use that encrypted log group.

5. Re-check Compliance

Verify in Log Group Details that Encryption shows your Customer-Managed Key.
Confirm Monitoring logs you care about are in that log group.

Note: Existing log data written before enabling CMK encryption is not re-encrypted; only new data is written under the KMS key.

Using CLI

Below is how to remediate “OCI Logging Logs Should Be Encrypted With KMS Keys” for Logging (including Monitoring service logs) using the OCI CLI.The key point: encryption is configured on the Log Group, not per individual log. So you must attach a KMS key to the log group that contains your Monitoring logs.

1. Prerequisites

OCI CLI installed and configured (oci setup config done).
You know:
- Your tenancy OCID
- Target compartment OCID where the log group lives
You have permission to:
- Use / manage KMS keys
- Manage Log Groups

2. Create or Identify a KMS Key

If you already have an appropriate KMS key, skip to step 3.

2.1. Find the KMS Vault

oci kms management vault list \
  --compartment-id <COMPARTMENT_OCID>

Pick a vault OCID from the output: ocid1.vault.oc1...

2.2. Create a New KMS Key

oci kms management key create \
  --compartment-id <COMPARTMENT_OCID> \
  --display-name "logging-encryption-key" \
  --vault-id <VAULT_OCID> \
  --protection-mode HSM

From the output, capture the id field → this is your KMS key OCID: <KMS_KEY_OCID>

3. Ensure KMS Key Policy Allows Logging Service

Get the current key policy:

oci kms management key get \
  --key-id <KMS_KEY_OCID> \
  --endpoint <KMS_MANAGEMENT_ENDPOINT> \
  --query 'data."policy"' \
  --raw-output

<KMS_MANAGEMENT_ENDPOINT> looks like: https://management.kms.<region>.oraclecloud.comYour key policy must allow the Logging service principal, for example:

{
  "resources": [
    "key"
  ],
  "statements": [
    {
      "actions": [
        "USE"
      ],
      "principal": [
        "logging"
      ],
      "effect": "ALLOW"
    }
  ]
}

If you need to update it, put the JSON into a file key_policy.json and run:

oci kms management key update \
  --key-id <KMS_KEY_OCID> \
  --endpoint <KMS_MANAGEMENT_ENDPOINT> \
  --policy file://key_policy.json

4. Find the Log Group for Monitoring Logs

List log groups in the compartment:

oci logging log-group list \
  --compartment-id <COMPARTMENT_OCID>

Identify the log group that contains your Monitoring service logs (often by display-name).Capture its OCID: <LOG_GROUP_OCID>If you’re unsure which log group:

oci logging log list \
  --log-group-id <LOG_GROUP_OCID>

Look for logs where:

source-service or display-name clearly indicate Monitoring.

5. Attach the KMS Key to the Log Group

Update the log group to use your KMS key:

oci logging log-group update \
  --log-group-id <LOG_GROUP_OCID> \
  --kms-key-id <KMS_KEY_OCID>

This sets the KMS key for all logs in that log group (including Monitoring service logs).

6. Verify Encryption Is Using KMS Key

Describe the log group:

oci logging log-group get \
  --log-group-id <LOG_GROUP_OCID> \
  --query 'data."kms-key-id"' \
  --raw-output

Expected output: your <KMS_KEY_OCID> (not empty or null).Optional: verify a specific Monitoring log is in that group:

oci logging log list \
  --log-group-id <LOG_GROUP_OCID> \
  --query 'data[].{"Name": "display-name", "Service": "source-service"}'

7. Apply to All Relevant Log Groups

Repeat steps 4–6 for each log group that holds logs you want encrypted with KMS (not just Monitoring).If you’d like, I can help you craft a small shell script to automatically attach the same KMS key to all log groups in a compartment.

Using Python

To encrypt OCI Logging logs (including Monitoring service logs) with a customer-managed KMS key using Python, you need to:

Create or identify a KMS key
Update the relevant Log Group(s) to use that KMS key

Below is a minimal step‑by‑step guide with Python code.

1. Prerequisites

OCI Python SDK installed:
pip install oci
A config file at ~/.oci/config (or equivalent) with:
- tenancy, user, fingerprint, key_file, region, etc.
OCIDs you need:
- log_group_id (for the log group where Monitoring logs are stored)
- kms_key_id (OCID of the KMS key you want to use)

If you don’t yet have a KMS key:

import oci

config = oci.config.from_file("~/.oci/config")
kms_management_client = oci.key_management.KmsManagementClient(config)

# Example: create a key in an existing Vault
create_key_details = oci.key_management.models.CreateKeyDetails(
    compartment_id="<COMPARTMENT_OCID>",
    display_name="logging-kms-key",
    key_shape=oci.key_management.models.KeyShape(algorithm="AES", length=32),
    protection_mode="HSM"  # or "SOFTWARE" depending on your config
)
key = kms_management_client.create_key(create_key_details).data
print("KMS key OCID:", key.id)

Use the printed key.id as kms_key_id below.

2. Update an Existing Log Group to Use the KMS Key

Encrypting logs in OCI Logging is done at the log group level by setting the kmsKeyId on the log group.

import oci

# Load config
config = oci.config.from_file("~/.oci/config")  # adjust path/PROFILE as needed
logging_client = oci.logging.LoggingManagementClient(config)

log_group_id = "<LOG_GROUP_OCID>"  # The log group that holds your Monitoring logs
kms_key_id   = "<KMS_KEY_OCID>"    # The customer-managed KMS key

# Get the existing log group
existing_log_group = logging_client.get_log_group(log_group_id).data

# Prepare update details – only kms_key_id is required for encryption change
update_details = oci.logging.models.UpdateLogGroupDetails(
    description=existing_log_group.description,
    display_name=existing_log_group.display_name,
    defined_tags=existing_log_group.defined_tags,
    freeform_tags=existing_log_group.freeform_tags,
    kms_key_id=kms_key_id     # <- This is the key field to enable CMEK encryption
)

# Update the log group
response = logging_client.update_log_group(
    log_group_id=log_group_id,
    update_log_group_details=update_details
)

print("Updated log group KMS key:", response.data.kms_key_id)

Once this is applied:

All new data written to logs in this log group (including Monitoring service logs routed there) will be encrypted with the specified KMS key.
Existing encrypted data (if any) remains under its previous key; OCI does not retroactively re-encrypt old data.

3. Verifying

Use the SDK or Console to confirm:

result = logging_client.get_log_group(log_group_id).data
print("Current KMS key on log group:", result.kms_key_id)

If this prints the kms_key_id you set, the log group is now using a customer-managed KMS key for encryption.

Using Terraform

# Log Group for Monitoring service logs, encrypted with a customer-managed KMS key
resource "oci_logging_log_group" "monitoring_logs" {
  compartment_id = var.COMPARTMENT_OCID          # Replace with the OCID of the compartment
  display_name   = "monitoring-log-group"

  # Use a customer-managed KMS key for log encryption
  kms_key_id = var.KMS_KEY_OCID                  # Replace with the OCID of your KMS key
}

# Example: a Monitoring service log in this log group (optional context)
resource "oci_logging_log" "monitoring_service_log" {
  display_name = "monitoring-service-log"

  compartment_id = var.COMPARTMENT_OCID
  log_group_id   = oci_logging_log_group.monitoring_logs.id
  log_type       = "SERVICE"

  configuration {
    source {
      category    = "oci_monitoring"             # Example Monitoring category
      resource    = var.MONITORING_RESOURCE_OCID # Replace with the monitored resource OCID if needed
      service     = "monitoring"
      source_type = "OCISERVICE"
    }
  }

  is_enabled = true
}

Changing or adding kms_key_id on oci_logging_log_group is an in-place update and does not force replacement of the log group.To verify, terraform plan should show an update to the existing oci_logging_log_group with kms_key_id changing from null (or the old key OCID) to the specified var.KMS_KEY_OCID.

OCI Misconfigurations

OCI Logging Logs Should Be Encrypted With KMS Keys

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Create / Identify a Vault and KMS Key

2. Add IAM Policies So Logging Can Use the Key

3. Configure Log Group Encryption With Your KMS Key

4. Ensure Monitoring Is Sending Logs to That Encrypted Log Group

5. Re-check Compliance

1. Prerequisites

2. Create or Identify a KMS Key

2.1. Find the KMS Vault

2.2. Create a New KMS Key

3. Ensure KMS Key Policy Allows Logging Service

4. Find the Log Group for Monitoring Logs

5. Attach the KMS Key to the Log Group

6. Verify Encryption Is Using KMS Key

7. Apply to All Relevant Log Groups

1. Prerequisites

2. Update an Existing Log Group to Use the KMS Key

3. Verifying

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Create / Identify a Vault and KMS Key

​2. Add IAM Policies So Logging Can Use the Key

​3. Configure Log Group Encryption With Your KMS Key

​4. Ensure Monitoring Is Sending Logs to That Encrypted Log Group

​5. Re-check Compliance

​1. Prerequisites

​2. Create or Identify a KMS Key

​2.1. Find the KMS Vault

​2.2. Create a New KMS Key

​3. Ensure KMS Key Policy Allows Logging Service

​4. Find the Log Group for Monitoring Logs

​5. Attach the KMS Key to the Log Group

​6. Verify Encryption Is Using KMS Key

​7. Apply to All Relevant Log Groups

​1. Prerequisites

​2. Update an Existing Log Group to Use the KMS Key

​3. Verifying

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Create / Identify a Vault and KMS Key

2. Add IAM Policies So Logging Can Use the Key

3. Configure Log Group Encryption With Your KMS Key

4. Ensure Monitoring Is Sending Logs to That Encrypted Log Group

5. Re-check Compliance

1. Prerequisites

2. Create or Identify a KMS Key

2.1. Find the KMS Vault

2.2. Create a New KMS Key

3. Ensure KMS Key Policy Allows Logging Service

4. Find the Log Group for Monitoring Logs

5. Attach the KMS Key to the Log Group

6. Verify Encryption Is Using KMS Key

7. Apply to All Relevant Log Groups

1. Prerequisites

2. Update an Existing Log Group to Use the KMS Key

3. Verifying