# 2.3 Ensure Retention Policies on Cloud Storage Buckets Used for Exporting Logs Are Configured Using Bucket Lock (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232957-2-3-ensure-retention-policies-on-cloud-storage-buckets-used-for-exporting-logs-are-configured-using-b - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability: Level 2 ### Description: It is recommended to enable retention policies and configure Bucket Lock on all Cloud Storage buckets used as log sinks. This ensures logs are protected from accidental deletion or modification, preserving them for forensic investigations and compliance purposes. ### Rationale: Cloud Logging allows logs to be exported to destinations like Cloud Storage via sinks. To safeguard these logs: 1. A retention policy ensures logs are stored for a specific period. 2. Bucket Lock permanently enforces the retention policy, preventing policy modifications or data deletion until the retention period expires. This prevents tampering or accidental deletion, even in the event of a security breach or malicious activity. ### Impact: - Irreversible Action: Once a bucket is locked, its retention policy cannot be removed or reduced. - Deletion Restriction: To delete the bucket, all objects must reach their retention period. ### Default Value: By default, storage buckets used as log sinks do not have retention policies or Bucket Lock configured. ### Audit Steps: #### Using Google Cloud Console: 1. Open the Cloud Storage browser: [Cloud Storage Console](https://console.cloud.google.com/storage/browser).            ![](https://support.icompaas.com/assets/kb/8a2e8ac3126e476a.png) 2. Ensure the Retention policy column is enabled in the display options.       ![](https://support.icompaas.com/assets/kb/59ffe78760914077.png) 3. Verify that: - Each log sink bucket has a retention period set. - A lock icon appears next to the retention period, indicating Bucket Lock is enabled. #### Using Google Cloud CLI: List sinks configured for storage buckets: gcloud logging sinks list --folder=FOLDER\_ID --organization=ORGANIZATION\_ID --project=PROJECT\_ID For each bucket listed, verify retention policies and Bucket Lock: gsutil retention get gs://BUCKET\_NAME - Ensure a retention period is set and Bucket Lock is enabled. ### Remediation Steps: #### Using Google Cloud Console: 1. Ensure log sinks are configured (refer to the recommendation on configuring log sinks). 2. Open the Cloud Storage browser for each sink bucket:nCloud Storage Console. ![](https://support.icompaas.com/assets/kb/84e9b7bcd6dbff48.png) 3. Navigate to the Bucket Lock tab.           ![](https://support.icompaas.com/assets/kb/5d63c3e8a492c95d.png) 4. Set a retention policy: - Click Add Duration, specify the retention period, and click Save policy.                       **![](https://support.icompaas.com/assets/kb/27af575f3b9e99b6.png)**  **![](https://support.icompaas.com/assets/kb/bd9e4db97eb2646e.png)** 5. Lock the retention policy by selecting Lock status and clicking Locked. #### **Using Google Cloud CLI:** **List sinks for storage buckets:** gcloud logging sinks list --folder=FOLDER\_ID --organization=ORGANIZATION\_ID --project=PROJECT\_ID **Set and lock a retention policy for each bucket:** gsutil retention set \[TIME\_DURATION\] gs://BUCKET\_NAME gsutil retention lock gs://BUCKET\_NAME ## Backout Plan: 1. ### If a Mistake is Made Before Locking - ### Modify the retention period before locking using: gsutil retention set gs:// 2. ###  If Bucket Lock is Already Enabled (Irreversible) - ### Wait for the retention period to expire before deleting logs. - ### Ensure retention policies are reviewed carefully before applying Bucket Lock. **References:** 1. **[Bucket Lock Overview](https://cloud.google.com/storage/docs/bucket-lock)** 2. **[Setting Retention Policies](https://cloud.google.com/storage/docs/using-bucket-lock#setpolicy)** 3. **[Cloud Logging Sinks](https://cloud.google.com/logging/docs/routing/overview)** ### **CIS Controls:**

Control

Description

IG 1

IG 2

IG 3

3.3 Configure Data Access Control Lists

Implement access controls to ensure only authorized individuals can access sensitive data.

✅

✅

✅

14.6 Protect Information through ACLs

Safeguard information using file system, network share, or database access control lists.

✅

✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.