Description

Ensure write-level service logging is enabled for every Object Storage bucket, so that write events such as object uploads, overwrites, and deletions are recorded in the OCI Logging service. These logs give a detailed audit trail of changes to bucket data.

Rationale

The Audit service records bucket-level API calls, but not every object-level change. Without write logs, it is hard to tell who uploaded, changed, or deleted a specific object, which slows down incident response and makes ransomware or data tampering harder to investigate. Write logging closes this gap.

Impact

  • Records object uploads, changes, and deletions

  • Supports investigations and compliance audits

  • Adds logging storage costs

Default Value

By default, service logging is not enabled for Object Storage buckets.

Pre-Requisites

  • Permission to manage buckets and logs in the compartment

  • A log group to store the logs (or create one during setup)

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.

  3. Open the Logs tab (under Resources on some consoles).

  4. Verify that the Write category shows logging as enabled (Active).

  5. If write logging is not enabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.

  3. Open the Logs tab.

  4. For the Write category, turn on the Enable log toggle.

  5. Select or create a log group, enter a log name, and select Enable log.

  6. Alternatively, open Observability & Management > Logging > Logs, select Enable service log, choose Object Storage, the bucket, and the Write Access Events category.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.

  3. Open the Logs tab and turn off the Enable log toggle for the Write category.

Reference