# Ensure Object Storage bucket has write-level logging enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698521467361-ensure-object-storage-bucket-has-write-level-logging-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure write-level service logging is enabled for every Object Storage bucket, so that write events such as object uploads, overwrites, and deletions are recorded in the OCI Logging service. These logs give a detailed audit trail of changes to bucket data.

**Rationale**

The Audit service records bucket-level API calls, but not every object-level change. Without write logs, it is hard to tell who uploaded, changed, or deleted a specific object, which slows down incident response and makes ransomware or data tampering harder to investigate. Write logging closes this gap.

**Impact**

-   Records object uploads, changes, and deletions
    
-   Supports investigations and compliance audits
    
-   Adds logging storage costs
    

**Default Value**

By default, service logging is not enabled for Object Storage buckets.

**Pre-Requisites**

-   Permission to manage buckets and logs in the compartment
    
-   A log group to store the logs (or create one during setup)
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.
    
3.  Open the Logs tab (under Resources on some consoles).
    
4.  Verify that the Write category shows logging as enabled (Active).
    
5.  If write logging is not enabled, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.
    
3.  Open the Logs tab.
    
4.  For the Write category, turn on the Enable log toggle.
    
5.  Select or create a log group, enter a log name, and select Enable log.
    
6.  Alternatively, open Observability & Management > Logging > Logs, select Enable service log, choose Object Storage, the bucket, and the Write Access Events category.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.
    
3.  Open the Logs tab and turn off the Enable log toggle for the Write category.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Logging/Reference/details\_for\_objectstorage.htm](https://docs.oracle.com/en-us/iaas/Content/Logging/Reference/details_for_objectstorage.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.