OCI Storage Buckets Should Have Write-Level Logging Enabled

Using Console

To enable write‑level logging for OCI Object Storage buckets using the OCI Console:

Sign in & choose compartment
- Log in to the OCI Console.
- In the top-left, select the Compartment where the bucket resides (or where you want the log group to live).
Create (or select) a Log Group
- Open the navigation menu → Observability & Management → Logging → Log Groups.
- Choose the correct compartment.
- Either:
  - Select an existing Log Group, or
  - Click Create Log Group, give it a name and (optionally) description, and click Create.
Create a Write‑Level Object Storage Log
- Within the chosen Log Group, click Create Log.
- Configure:
  - Log Name: e.g., object-storage-write-logs.
  - Service: select Object Storage.
  - Resource:
    - Choose Bucket, then pick the specific Bucket you want to monitor.
  - Log Category / Log Type: select Write (or Object Storage - Write, depending on UI wording).
- Leave other options (retention, etc.) as needed for your policy.
- Click Create (or Enable).
Verify Logging Is Enabled
- On the bucket details page:
  - Navigate to Storage → Buckets.
  - Open the bucket, then look for Logging or Logs section.
  - Confirm a Write log is attached (or confirm from the Logging → Logs page that the log is Active).
- Optionally, view recent log entries under Logging → Logs → select your log → Log Explorer to confirm write operations (PUT/DELETE, etc.) are recorded.
Repeat for All Relevant Buckets
- Repeat steps 3–4 for each bucket that must comply with the requirement.

This configuration satisfies the control “OCI Storage Buckets Should Have Write-Level Logging Enabled” using the OCI Console.

Using CLI

Below is a minimal step‑by‑step using OCI CLI to enable write‑level logging for an Object Storage bucket (i.e., to send write operations to OCI Logging for monitoring).Assumptions:

You already have OCI CLI configured (oci setup config completed).
You know the compartment OCID and bucket name.

1. Get the bucket OCID

# Replace these
COMPARTMENT_OCID="<your_compartment_ocid>"
NAMESPACE=$(oci os ns get --query 'data' --raw-output)
BUCKET_NAME="<your_bucket_name>"

oci os bucket get \
  --name "$BUCKET_NAME" \
  --namespace-name "$NAMESPACE" \
  --query 'data."id"' \
  --raw-output

Save the output as:

BUCKET_OCID="<output_from_previous_command>"

2. Create (or reuse) a Log Group

If you already have a log group, skip to step 3.

LOG_GROUP_NAME="objectstorage-logs"

oci logging log-group create \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$LOG_GROUP_NAME" \
  --query 'data."id"' \
  --raw-output

Save the output as:

LOG_GROUP_OCID="<output_from_previous_command>"

(If reusing an existing group, get its OCID with oci logging log-group list.)

3. Create a write‑level service log for the bucket

LOG_NAME="bucket-write-logs-$BUCKET_NAME"

oci logging log create \
  --log-group-id "$LOG_GROUP_OCID" \
  --display-name "$LOG_NAME" \
  --is-enabled true \
  --log-type SERVICE \
  --configuration "{
    \"source\": {
      \"category\": \"write\",
      \"resource\": \"$BUCKET_OCID\",
      \"service\": \"objectstorage\",
      \"sourceType\": \"OCID\"
    }
  }"

This configures a service log for Object Storage with the write category, bound to the specific bucket OCID.

4. Verify the log is enabled

oci logging log list \
  --log-group-id "$LOG_GROUP_OCID" \
  --query "data[?\"display-name\"=='$LOG_NAME']"

You should see "is-enabled": true and "configuration.source.category": "write".That’s all that is required to remediate: the bucket now has write‑level logging enabled via OCI Logging, using OCI CLI.

Using Python

Below is a minimal, end‑to‑end way to enable write‑level (DATA_WRITE) logging for an OCI Object Storage bucket using Python and the OCI SDK.

1. Prerequisites

Install OCI SDK:

pip install oci

Configure your OCI credentials (tenancy, user, key, region, etc.) via:
- ~/.oci/config (default profile), or
- Environment variables / instance principal / resource principal.
Collect:
- Compartment OCID where the bucket lives.
- Bucket OCID (not just name). You can get this via Console or SDK:
  - In the Console: Object Storage → Bucket → Bucket details → OCID.

2. Get or Create a Log Group

You need a Log Group in the same compartment to hold the bucket logs.

import oci

config = oci.config.from_file()  # or from_file("~/.oci/config", "PROFILE_NAME")

logging_mgmt_client = oci.logging.LoggingManagementClient(config)

compartment_id = "ocid1.compartment.oc1..xxxx"  # your compartment OCID

# Option 1: find existing log group (by name, tag, etc.)
def get_log_group(logging_mgmt_client, compartment_id, display_name):
    log_groups = oci.pagination.list_call_get_all_results(
        logging_mgmt_client.list_log_groups,
        compartment_id=compartment_id
    ).data
    for lg in log_groups:
        if lg.display_name == display_name:
            return lg
    return None

log_group_display_name = "objectstorage-logs"
log_group = get_log_group(logging_mgmt_client, compartment_id, log_group_display_name)

# Option 2: create one if it doesn’t exist
if log_group is None:
    create_lg_details = oci.logging.models.CreateLogGroupDetails(
        compartment_id=compartment_id,
        display_name=log_group_display_name,
        description="Log group for Object Storage bucket write logs"
    )
    log_group = logging_mgmt_client.create_log_group(create_lg_details).data

log_group_id = log_group.id

3. Create/Enable a Write‑Level Log for the Bucket

In the Logging service, Object Storage has categories such as write and read.
To satisfy “write‑level logging”, you must enable the write category for the bucket.

bucket_ocid = "ocid1.bucket.oc1..xxxx"  # your bucket OCID

# Check if a log already exists for this bucket + write category
def find_bucket_write_log(logging_mgmt_client, log_group_id, bucket_ocid):
    logs = oci.pagination.list_call_get_all_results(
        logging_mgmt_client.list_logs,
        log_group_id=log_group_id
    ).data

    for log in logs:
        src = log.configuration.source
        if (
            log.lifecycle_state == "ACTIVE"
            and src.service == "objectstorage"
            and src.resource == bucket_ocid
            and src.category == "write"
        ):
            return log
    return None

existing_log = find_bucket_write_log(logging_mgmt_client, log_group_id, bucket_ocid)

if existing_log:
    # Ensure it is enabled
    if not existing_log.is_enabled:
        update_details = oci.logging.models.UpdateLogDetails(
            is_enabled=True
        )
        logging_mgmt_client.update_log(
            log_group_id=log_group_id,
            log_id=existing_log.id,
            update_log_details=update_details
        )
    print(f"Write-level logging already enabled for bucket {bucket_ocid}")
else:
    # Create new SERVICE log for Object Storage write operations
    create_log_details = oci.logging.models.CreateLogDetails(
        display_name="bucket-write-log",
        log_type="SERVICE",
        is_enabled=True,
        configuration=oci.logging.models.LogConfiguration(
            source=oci.logging.models.LogSource(
                service="objectstorage",
                category="write",      # write-level
                resource=bucket_ocid,  # bucket OCID
                source_type="OCISERVICE"
            )
        ),
        # optional: tags, retention, etc.
        # retention_duration=30   # days
    )

    new_log = logging_mgmt_client.create_log(
        log_group_id=log_group_id,
        create_log_details=create_log_details
    ).data

    print(f"Enabled write-level logging for bucket {bucket_ocid} in log group {log_group_id}")

4. (Optional) Send Logs to Monitoring / Metrics

If by “Storage Monitoring” you also want metrics or alarms:

Create a Service Connector (Console or SDK) with:
- Source: Logging (your log group/log).
- Target: Monitoring / Logging Analytics / Object Storage.
Build Monitoring queries/alarms on those logs/derived metrics.

That part depends on your specific monitoring design, but is separate from enabling write‑level logging, which the above Python code accomplishes.

Using Terraform

# Existing bucket (example)
resource "oci_objectstorage_bucket" "TARGET_BUCKET" {
  compartment_id = "OCID_OF_BUCKET_COMPARTMENT"
  name           = "BUCKET_NAME"
  namespace      = "OBJECTSTORAGE_NAMESPACE"

  # ...other existing arguments...
}

# Log group to hold Object Storage logs
resource "oci_logging_log_group" "OBJECTSTORAGE_LOG_GROUP" {
  compartment_id = oci_objectstorage_bucket.TARGET_BUCKET.compartment_id
  display_name   = "OBJECTSTORAGE_WRITE_LOG_GROUP"
  description    = "Log group for Object Storage write-level logs"
}

# Enable write-level (object-level) logging for the bucket
resource "oci_logging_log" "OBJECTSTORAGE_WRITE_LOG" {
  display_name = "OBJECTSTORAGE_WRITE_LOG"
  log_group_id = oci_logging_log_group.OBJECTSTORAGE_LOG_GROUP.id

  # Log type "SERVICE" enables OCI service logs
  log_type = "SERVICE"

  is_enabled = true

  configuration {
    source {
      # Service name for Object Storage
      service  = "objectstorage"

      # Category "write" enables write-level logging
      category = "write"

      # Target bucket OCID for which to capture write events
      resource = oci_objectstorage_bucket.TARGET_BUCKET.id
    }
  }
}

This change does not force replacement of the existing bucket; it adds separate logging resources.Verification: terraform plan should show + (create) for oci_logging_log_group.OBJECTSTORAGE_LOG_GROUP and oci_logging_log.OBJECTSTORAGE_WRITE_LOG, with is_enabled = true, service = "objectstorage", category = "write", and resource set to the bucket OCID.

OCI Misconfigurations

OCI Storage Buckets Should Have Write-Level Logging Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Get the bucket OCID

2. Create (or reuse) a Log Group

3. Create a write‑level service log for the bucket

4. Verify the log is enabled

1. Prerequisites

2. Get or Create a Log Group

3. Create/Enable a Write‑Level Log for the Bucket

4. (Optional) Send Logs to Monitoring / Metrics

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Get the bucket OCID

​2. Create (or reuse) a Log Group

​3. Create a write‑level service log for the bucket

​4. Verify the log is enabled

​1. Prerequisites

​2. Get or Create a Log Group

​3. Create/Enable a Write‑Level Log for the Bucket

​4. (Optional) Send Logs to Monitoring / Metrics

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Get the bucket OCID

2. Create (or reuse) a Log Group

3. Create a write‑level service log for the bucket

4. Verify the log is enabled

1. Prerequisites

2. Get or Create a Log Group

3. Create/Enable a Write‑Level Log for the Bucket

4. (Optional) Send Logs to Monitoring / Metrics