Description

Ensure the OCI Audit service retains audit logs for at least 365 days. Audit logs record every API call made in the tenancy, including who made the change, when, and from where, and are needed for security investigations and compliance.

Rationale

Security incidents are often discovered weeks or months after they happen. If audit logs are deleted too soon, there may be no record of what an attacker did. Oracle now retains audit logs for 365 days in commercial tenancies, but the setting should still be verified, and logs needed for longer should be exported to Object Storage or a SIEM.

Impact

  • Audit history is available for a full year

  • Supports investigations and compliance audits

  • Longer retention requires exporting logs, which adds storage costs

Default Value

Oracle documentation states that audit logs are retained for 365 days and that this can't be changed in the Console. Older tenancies set through the API may show a value between 90 and 365 days.

Pre-Requisites

  • Tenancy administrator access

  • OCI CLI access if the value must be updated

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the Profile menu and select Tenancy (Tenancy details).

  3. Check the Audit retention period value.

  4. Alternatively, run: oci audit config get --compartment-id <tenancy-ocid> and check retentionPeriodDays.

  5. If the value is less than 365, follow the implementation steps.

Implementation Steps

  1. Open Cloud Shell or a terminal with the OCI CLI configured as a tenancy administrator.

  2. Run: oci audit config update --compartment-id <tenancy-ocid> --retention-period-days 365

  3. Run: oci audit config get --compartment-id <tenancy-ocid> and confirm the value is 365.

  4. If logs must be kept for more than 365 days, use Connector Hub to copy audit logs to an Object Storage bucket or a SIEM.

Backout Plan

  1. Run: oci audit config update --compartment-id <tenancy-ocid> --retention-period-days <previous-value>

Reference