> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Storage Buckets Should Have Write-Level Logging Enabled

### More Info:

Object Storage buckets should have object-level logging enabled. Logging is critical for monitoring access patterns, investigating potential security incidents, and meeting rigorous compliance auditing requirements.

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* FedRAMP
* GDPR
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To enable **write‑level logging for OCI Object Storage buckets** using the OCI Console:

        1. **Sign in & choose compartment**
           * Log in to the OCI Console.
           * In the top-left, select the **Compartment** where the bucket resides (or where you want the log group to live).

        2. **Create (or select) a Log Group**
           * Open the navigation menu → **Observability & Management** → **Logging** → **Log Groups**.
           * Choose the correct compartment.
           * Either:
             * Select an existing **Log Group**, or
             * Click **Create Log Group**, give it a name and (optionally) description, and click **Create**.

        3. **Create a Write‑Level Object Storage Log**
           * Within the chosen Log Group, click **Create Log**.
           * Configure:
             * **Log Name**: e.g., `object-storage-write-logs`.
             * **Service**: select **Object Storage**.
             * **Resource**:
               * Choose **Bucket**, then pick the specific **Bucket** you want to monitor.
             * **Log Category / Log Type**: select **Write** (or **Object Storage - Write**, depending on UI wording).
           * Leave other options (retention, etc.) as needed for your policy.
           * Click **Create** (or **Enable**).

        4. **Verify Logging Is Enabled**
           * On the bucket details page:
             * Navigate to **Storage** → **Buckets**.
             * Open the bucket, then look for **Logging** or **Logs** section.
             * Confirm a **Write** log is attached (or confirm from the **Logging** → **Logs** page that the log is `Active`).
           * Optionally, view recent log entries under **Logging** → **Logs** → select your log → **Log Explorer** to confirm write operations (PUT/DELETE, etc.) are recorded.

        5. **Repeat for All Relevant Buckets**
           * Repeat steps 3–4 for each bucket that must comply with the requirement.

        This configuration satisfies the control “OCI Storage Buckets Should Have Write-Level Logging Enabled” using the OCI Console.
      </Accordion>

      <Accordion title="Using CLI">
        Below is a minimal step‑by‑step using **OCI CLI** to enable **write‑level logging** for an Object Storage bucket (i.e., to send write operations to OCI Logging for monitoring).

        Assumptions:

        * You already have OCI CLI configured (`oci setup config` completed).
        * You know the **compartment OCID** and **bucket name**.

        ***

        ### 1. Get the bucket OCID

        ```bash theme={null}
        # Replace these
        COMPARTMENT_OCID="<your_compartment_ocid>"
        NAMESPACE=$(oci os ns get --query 'data' --raw-output)
        BUCKET_NAME="<your_bucket_name>"

        oci os bucket get \
          --name "$BUCKET_NAME" \
          --namespace-name "$NAMESPACE" \
          --query 'data."id"' \
          --raw-output
        ```

        Save the output as:

        ```bash theme={null}
        BUCKET_OCID="<output_from_previous_command>"
        ```

        ***

        ### 2. Create (or reuse) a Log Group

        If you already have a log group, skip to step 3.

        ```bash theme={null}
        LOG_GROUP_NAME="objectstorage-logs"

        oci logging log-group create \
          --compartment-id "$COMPARTMENT_OCID" \
          --display-name "$LOG_GROUP_NAME" \
          --query 'data."id"' \
          --raw-output
        ```

        Save the output as:

        ```bash theme={null}
        LOG_GROUP_OCID="<output_from_previous_command>"
        ```

        (If reusing an existing group, get its OCID with `oci logging log-group list`.)

        ***

        ### 3. Create a **write‑level service log** for the bucket

        ```bash theme={null}
        LOG_NAME="bucket-write-logs-$BUCKET_NAME"

        oci logging log create \
          --log-group-id "$LOG_GROUP_OCID" \
          --display-name "$LOG_NAME" \
          --is-enabled true \
          --log-type SERVICE \
          --configuration "{
            \"source\": {
              \"category\": \"write\",
              \"resource\": \"$BUCKET_OCID\",
              \"service\": \"objectstorage\",
              \"sourceType\": \"OCID\"
            }
          }"
        ```

        This configures a **service log** for Object Storage with the **write** category, bound to the specific bucket OCID.

        ***

        ### 4. Verify the log is enabled

        ```bash theme={null}
        oci logging log list \
          --log-group-id "$LOG_GROUP_OCID" \
          --query "data[?\"display-name\"=='$LOG_NAME']"
        ```

        You should see `"is-enabled": true` and `"configuration.source.category": "write"`.

        That’s all that is required to remediate: the bucket now has **write‑level logging enabled** via OCI Logging, using OCI CLI.
      </Accordion>

      <Accordion title="Using Python">
        Below is a minimal, end‑to‑end way to enable **write‑level (DATA\_WRITE) logging** for an OCI Object Storage bucket using Python and the OCI SDK.

        ***

        ## 1. Prerequisites

        1. Install OCI SDK:

        ```bash theme={null}
        pip install oci
        ```

        2. Configure your OCI credentials (tenancy, user, key, region, etc.) via:
           * `~/.oci/config` (default profile), or
           * Environment variables / instance principal / resource principal.

        3. Collect:
           * **Compartment OCID** where the bucket lives.
           * **Bucket OCID** (not just name). You can get this via Console or SDK:
             * In the Console: Object Storage → Bucket → Bucket details → OCID.

        ***

        ## 2. Get or Create a Log Group

        You need a **Log Group** in the same compartment to hold the bucket logs.

        ```python theme={null}
        import oci

        config = oci.config.from_file()  # or from_file("~/.oci/config", "PROFILE_NAME")

        logging_mgmt_client = oci.logging.LoggingManagementClient(config)

        compartment_id = "ocid1.compartment.oc1..xxxx"  # your compartment OCID

        # Option 1: find existing log group (by name, tag, etc.)
        def get_log_group(logging_mgmt_client, compartment_id, display_name):
            log_groups = oci.pagination.list_call_get_all_results(
                logging_mgmt_client.list_log_groups,
                compartment_id=compartment_id
            ).data
            for lg in log_groups:
                if lg.display_name == display_name:
                    return lg
            return None

        log_group_display_name = "objectstorage-logs"
        log_group = get_log_group(logging_mgmt_client, compartment_id, log_group_display_name)

        # Option 2: create one if it doesn’t exist
        if log_group is None:
            create_lg_details = oci.logging.models.CreateLogGroupDetails(
                compartment_id=compartment_id,
                display_name=log_group_display_name,
                description="Log group for Object Storage bucket write logs"
            )
            log_group = logging_mgmt_client.create_log_group(create_lg_details).data

        log_group_id = log_group.id
        ```

        ***

        ## 3. Create/Enable a Write‑Level Log for the Bucket

        In the Logging service, Object Storage has categories such as `write` and `read`.\
        To satisfy “write‑level logging”, you must enable the `write` category for the bucket.

        ```python theme={null}
        bucket_ocid = "ocid1.bucket.oc1..xxxx"  # your bucket OCID

        # Check if a log already exists for this bucket + write category
        def find_bucket_write_log(logging_mgmt_client, log_group_id, bucket_ocid):
            logs = oci.pagination.list_call_get_all_results(
                logging_mgmt_client.list_logs,
                log_group_id=log_group_id
            ).data

            for log in logs:
                src = log.configuration.source
                if (
                    log.lifecycle_state == "ACTIVE"
                    and src.service == "objectstorage"
                    and src.resource == bucket_ocid
                    and src.category == "write"
                ):
                    return log
            return None

        existing_log = find_bucket_write_log(logging_mgmt_client, log_group_id, bucket_ocid)

        if existing_log:
            # Ensure it is enabled
            if not existing_log.is_enabled:
                update_details = oci.logging.models.UpdateLogDetails(
                    is_enabled=True
                )
                logging_mgmt_client.update_log(
                    log_group_id=log_group_id,
                    log_id=existing_log.id,
                    update_log_details=update_details
                )
            print(f"Write-level logging already enabled for bucket {bucket_ocid}")
        else:
            # Create new SERVICE log for Object Storage write operations
            create_log_details = oci.logging.models.CreateLogDetails(
                display_name="bucket-write-log",
                log_type="SERVICE",
                is_enabled=True,
                configuration=oci.logging.models.LogConfiguration(
                    source=oci.logging.models.LogSource(
                        service="objectstorage",
                        category="write",      # write-level
                        resource=bucket_ocid,  # bucket OCID
                        source_type="OCISERVICE"
                    )
                ),
                # optional: tags, retention, etc.
                # retention_duration=30   # days
            )

            new_log = logging_mgmt_client.create_log(
                log_group_id=log_group_id,
                create_log_details=create_log_details
            ).data

            print(f"Enabled write-level logging for bucket {bucket_ocid} in log group {log_group_id}")
        ```

        ***

        ## 4. (Optional) Send Logs to Monitoring / Metrics

        If by “Storage Monitoring” you also want metrics or alarms:

        1. Create a **Service Connector** (Console or SDK) with:
           * Source: Logging (your log group/log).
           * Target: Monitoring / Logging Analytics / Object Storage.
        2. Build Monitoring queries/alarms on those logs/derived metrics.

        That part depends on your specific monitoring design, but is separate from enabling **write‑level logging**, which the above Python code accomplishes.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Existing bucket (example)
        resource "oci_objectstorage_bucket" "TARGET_BUCKET" {
          compartment_id = "OCID_OF_BUCKET_COMPARTMENT"
          name           = "BUCKET_NAME"
          namespace      = "OBJECTSTORAGE_NAMESPACE"

          # ...other existing arguments...
        }

        # Log group to hold Object Storage logs
        resource "oci_logging_log_group" "OBJECTSTORAGE_LOG_GROUP" {
          compartment_id = oci_objectstorage_bucket.TARGET_BUCKET.compartment_id
          display_name   = "OBJECTSTORAGE_WRITE_LOG_GROUP"
          description    = "Log group for Object Storage write-level logs"
        }

        # Enable write-level (object-level) logging for the bucket
        resource "oci_logging_log" "OBJECTSTORAGE_WRITE_LOG" {
          display_name = "OBJECTSTORAGE_WRITE_LOG"
          log_group_id = oci_logging_log_group.OBJECTSTORAGE_LOG_GROUP.id

          # Log type "SERVICE" enables OCI service logs
          log_type = "SERVICE"

          is_enabled = true

          configuration {
            source {
              # Service name for Object Storage
              service  = "objectstorage"

              # Category "write" enables write-level logging
              category = "write"

              # Target bucket OCID for which to capture write events
              resource = oci_objectstorage_bucket.TARGET_BUCKET.id
            }
          }
        }
        ```

        This change does not force replacement of the existing bucket; it adds separate logging resources.

        Verification: `terraform plan` should show `+` (create) for `oci_logging_log_group.OBJECTSTORAGE_LOG_GROUP` and `oci_logging_log.OBJECTSTORAGE_WRITE_LOG`, with `is_enabled = true`, `service = "objectstorage"`, `category = "write"`, and `resource` set to the bucket OCID.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>