> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Logging Logs Should Be Encrypted With KMS Keys

### More Info:

Log data should be encrypted with customer-managed KMS keys. Encrypting logs protects sensitive information from unauthorized access if storage is compromised.

### Risk Level

High

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Startup Security Baseline
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* GDPR
* HIPAA
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Cyber Security Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are the console-based steps to ensure **OCI Logging (including Monitoring logs) is encrypted with a customer-managed KMS key**.

        ***

        ### 1. Create / Identify a Vault and KMS Key

        1. In the OCI Console, open the navigation menu.
        2. Go to **Governance & Administration → Security → Vault**.
        3. Choose the **compartment** where you want the key to live.
        4. If you don’t have a vault yet:
           * Click **Create vault**.
           * Give it a name, select **Type: Default** (or as required), and **Create**.
           * Wait until the vault is **Active**.
        5. Open the vault.
        6. Go to the **Master Encryption Keys** tab.
        7. Click **Create key**:
           * Key type: **Encrypt/Decrypt**
           * Name and description as needed (e.g., `logging-monitoring-key`).
           * Protection mode: **HSM** (typical) or as per your standards.
           * Click **Create key**.

        ***

        ### 2. Add IAM Policies So Logging Can Use the Key

        1. Go to **Identity & Security → Policies**.

        2. Choose the compartment where you want to define the policy (often **tenancy root** or the compartment of the logs).

        3. Click **Create Policy** (or edit an existing one).

        4. Add statements like (adjust compartment/tenancy as needed):

           ```text theme={null}
           Allow service logging to use keys in tenancy
           Allow service loganalytics to use keys in tenancy
           ```

           Or limit to a specific compartment:

           ```text theme={null}
           Allow service logging to use keys in compartment <compartment-name>
           Allow service loganalytics to use keys in compartment <compartment-name>
           ```

        5. **Save** the policy.

        ***

        ### 3. Configure Log Group Encryption With Your KMS Key

        Monitoring service logs are stored in **Log Groups** in OCI Logging, and encryption is set at the **log group** level.

        1. Go to **Observability & Management → Logging → Log Groups**.

        2. In the left, select the **compartment** where your **Monitoring logs’ Log Group** resides (or where you will create it).

        3. Either:
           * **Use existing Log Group** that contains Monitoring logs, or
           * Click **Create log group** (e.g., name: `monitoring-logs-group`) to isolate Monitoring logs.

        4. Select the log group.

        5. In the log group details page, find **Encryption** (or **Encryption Key**).

        6. Click **Edit** / **Update**:
           * Choose **Encrypt using Customer-Managed Key (CMK)**.
           * Select the **Vault** and then the **Key** you created earlier.
           * **Save / Update**.

        From this point on, new log entries in that log group will be encrypted with the KMS key.

        ***

        ### 4. Ensure Monitoring Is Sending Logs to That Encrypted Log Group

        1. Go to **Observability & Management → Logging → Logs**.
        2. Filter by the **compartment** and **Log Group** you just configured.
        3. For each **Monitoring log** (e.g., service logs or custom logs from Monitoring):
           * Ensure the **Log Group** selected is the one encrypted with your CMK.
           * If needed, recreate or modify the log to use that encrypted log group.

        ***

        ### 5. Re-check Compliance

        * Verify in **Log Group Details** that **Encryption** shows your **Customer-Managed Key**.
        * Confirm Monitoring logs you care about are in that log group.

        Note: Existing log data written before enabling CMK encryption is not re-encrypted; only new data is written under the KMS key.
      </Accordion>

      <Accordion title="Using CLI">
        Below is how to remediate **“OCI Logging Logs Should Be Encrypted With KMS Keys”** for **Logging (including Monitoring service logs)** using the **OCI CLI**.

        The key point: **encryption is configured on the Log Group**, not per individual log. So you must attach a KMS key to the log group that contains your Monitoring logs.

        ***

        ## 1. Prerequisites

        1. OCI CLI installed and configured (`oci setup config` done).
        2. You know:
           * Your **tenancy OCID**
           * Target **compartment OCID** where the log group lives
        3. You have permission to:
           * Use / manage KMS keys
           * Manage Log Groups

        ***

        ## 2. Create or Identify a KMS Key

        If you already have an appropriate KMS key, skip to step 3.

        ### 2.1. Find the KMS Vault

        ```bash theme={null}
        oci kms management vault list \
          --compartment-id <COMPARTMENT_OCID>
        ```

        Pick a vault OCID from the output: `ocid1.vault.oc1...`

        ### 2.2. Create a New KMS Key

        ```bash theme={null}
        oci kms management key create \
          --compartment-id <COMPARTMENT_OCID> \
          --display-name "logging-encryption-key" \
          --vault-id <VAULT_OCID> \
          --protection-mode HSM
        ```

        From the output, capture the `id` field → this is your **KMS key OCID**:
        `<KMS_KEY_OCID>`

        ***

        ## 3. Ensure KMS Key Policy Allows Logging Service

        Get the current key policy:

        ```bash theme={null}
        oci kms management key get \
          --key-id <KMS_KEY_OCID> \
          --endpoint <KMS_MANAGEMENT_ENDPOINT> \
          --query 'data."policy"' \
          --raw-output
        ```

        `<KMS_MANAGEMENT_ENDPOINT>` looks like:
        `https://management.kms.<region>.oraclecloud.com`

        Your key policy must allow the Logging service principal, for example:

        ```json theme={null}
        {
          "resources": [
            "key"
          ],
          "statements": [
            {
              "actions": [
                "USE"
              ],
              "principal": [
                "logging"
              ],
              "effect": "ALLOW"
            }
          ]
        }
        ```

        If you need to update it, put the JSON into a file `key_policy.json` and run:

        ```bash theme={null}
        oci kms management key update \
          --key-id <KMS_KEY_OCID> \
          --endpoint <KMS_MANAGEMENT_ENDPOINT> \
          --policy file://key_policy.json
        ```

        ***

        ## 4. Find the Log Group for Monitoring Logs

        List log groups in the compartment:

        ```bash theme={null}
        oci logging log-group list \
          --compartment-id <COMPARTMENT_OCID>
        ```

        Identify the log group that contains your Monitoring service logs (often by `display-name`).

        Capture its OCID: `<LOG_GROUP_OCID>`

        If you’re unsure which log group:

        ```bash theme={null}
        oci logging log list \
          --log-group-id <LOG_GROUP_OCID>
        ```

        Look for logs where:

        * `source-service` or `display-name` clearly indicate **Monitoring**.

        ***

        ## 5. Attach the KMS Key to the Log Group

        Update the log group to use your KMS key:

        ```bash theme={null}
        oci logging log-group update \
          --log-group-id <LOG_GROUP_OCID> \
          --kms-key-id <KMS_KEY_OCID>
        ```

        This sets the KMS key for all logs in that log group (including Monitoring service logs).

        ***

        ## 6. Verify Encryption Is Using KMS Key

        Describe the log group:

        ```bash theme={null}
        oci logging log-group get \
          --log-group-id <LOG_GROUP_OCID> \
          --query 'data."kms-key-id"' \
          --raw-output
        ```

        Expected output: your `<KMS_KEY_OCID>` (not empty or null).

        Optional: verify a specific Monitoring log is in that group:

        ```bash theme={null}
        oci logging log list \
          --log-group-id <LOG_GROUP_OCID> \
          --query 'data[].{"Name": "display-name", "Service": "source-service"}'
        ```

        ***

        ## 7. Apply to All Relevant Log Groups

        Repeat steps **4–6** for each log group that holds logs you want encrypted with KMS (not just Monitoring).

        If you’d like, I can help you craft a small shell script to automatically attach the same KMS key to all log groups in a compartment.
      </Accordion>

      <Accordion title="Using Python">
        To encrypt OCI Logging logs (including Monitoring service logs) with a customer-managed KMS key using Python, you need to:

        1. Create or identify a KMS key
        2. Update the relevant Log Group(s) to use that KMS key

        Below is a minimal step‑by‑step guide with Python code.

        ***

        ## 1. Prerequisites

        * OCI Python SDK installed:
          ```bash theme={null}
          pip install oci
          ```
        * A config file at `~/.oci/config` (or equivalent) with:
          * tenancy, user, fingerprint, key\_file, region, etc.
        * OCIDs you need:
          * `log_group_id` (for the log group where Monitoring logs are stored)
          * `kms_key_id` (OCID of the KMS key you want to use)

        If you don’t yet have a KMS key:

        ```python theme={null}
        import oci

        config = oci.config.from_file("~/.oci/config")
        kms_management_client = oci.key_management.KmsManagementClient(config)

        # Example: create a key in an existing Vault
        create_key_details = oci.key_management.models.CreateKeyDetails(
            compartment_id="<COMPARTMENT_OCID>",
            display_name="logging-kms-key",
            key_shape=oci.key_management.models.KeyShape(algorithm="AES", length=32),
            protection_mode="HSM"  # or "SOFTWARE" depending on your config
        )
        key = kms_management_client.create_key(create_key_details).data
        print("KMS key OCID:", key.id)
        ```

        Use the printed `key.id` as `kms_key_id` below.

        ***

        ## 2. Update an Existing Log Group to Use the KMS Key

        Encrypting logs in OCI Logging is done at the **log group** level by setting the `kmsKeyId` on the log group.

        ```python theme={null}
        import oci

        # Load config
        config = oci.config.from_file("~/.oci/config")  # adjust path/PROFILE as needed
        logging_client = oci.logging.LoggingManagementClient(config)

        log_group_id = "<LOG_GROUP_OCID>"  # The log group that holds your Monitoring logs
        kms_key_id   = "<KMS_KEY_OCID>"    # The customer-managed KMS key

        # Get the existing log group
        existing_log_group = logging_client.get_log_group(log_group_id).data

        # Prepare update details – only kms_key_id is required for encryption change
        update_details = oci.logging.models.UpdateLogGroupDetails(
            description=existing_log_group.description,
            display_name=existing_log_group.display_name,
            defined_tags=existing_log_group.defined_tags,
            freeform_tags=existing_log_group.freeform_tags,
            kms_key_id=kms_key_id     # <- This is the key field to enable CMEK encryption
        )

        # Update the log group
        response = logging_client.update_log_group(
            log_group_id=log_group_id,
            update_log_group_details=update_details
        )

        print("Updated log group KMS key:", response.data.kms_key_id)
        ```

        Once this is applied:

        * All new data written to logs in this log group (including Monitoring service logs routed there) will be encrypted with the specified KMS key.
        * Existing encrypted data (if any) remains under its previous key; OCI does not retroactively re-encrypt old data.

        ***

        ## 3. Verifying

        Use the SDK or Console to confirm:

        ```python theme={null}
        result = logging_client.get_log_group(log_group_id).data
        print("Current KMS key on log group:", result.kms_key_id)
        ```

        If this prints the `kms_key_id` you set, the log group is now using a customer-managed KMS key for encryption.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Log Group for Monitoring service logs, encrypted with a customer-managed KMS key
        resource "oci_logging_log_group" "monitoring_logs" {
          compartment_id = var.COMPARTMENT_OCID          # Replace with the OCID of the compartment
          display_name   = "monitoring-log-group"

          # Use a customer-managed KMS key for log encryption
          kms_key_id = var.KMS_KEY_OCID                  # Replace with the OCID of your KMS key
        }

        # Example: a Monitoring service log in this log group (optional context)
        resource "oci_logging_log" "monitoring_service_log" {
          display_name = "monitoring-service-log"

          compartment_id = var.COMPARTMENT_OCID
          log_group_id   = oci_logging_log_group.monitoring_logs.id
          log_type       = "SERVICE"

          configuration {
            source {
              category    = "oci_monitoring"             # Example Monitoring category
              resource    = var.MONITORING_RESOURCE_OCID # Replace with the monitored resource OCID if needed
              service     = "monitoring"
              source_type = "OCISERVICE"
            }
          }

          is_enabled = true
        }
        ```

        Changing or adding `kms_key_id` on `oci_logging_log_group` is an in-place update and does not force replacement of the log group.

        To verify, `terraform plan` should show an update to the existing `oci_logging_log_group` with `kms_key_id` changing from `null` (or the old key OCID) to the specified `var.KMS_KEY_OCID`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>