Control: 4.17 Ensure write level Object Storage logging is enabled for all buckets

Description

Object Storage write logs will log all write requests made to objects in a bucket.

Enabling an Object Storage write log, the requestAction property would contain values of PUT, POST, or DELETE. This will provide you more visibility into changes to objects in your buckets.

Remediation

From Console

First, if a log group for holding these logs has not already been created, create a log group by the following steps:

1. Go to the Log Groups page.
2. Click the Create Log Groups button in the middle of the screen.
3. Select the relevant compartment to place these logs.
4. Type a name for the log group in the Name box.
5. Add an optional description in the Description box.
6. Click the Create button in the lower left hand corner.

Second, enable Object Storage write log logging for your bucket(s) by the following steps:

1. Go to the Logs page.
2. Click the Enable Service Log button in the middle of the screen.
3. Select the relevant resource compartment.
4. Select Object Storage from the Service drop down menu.
5. Select the relevant bucket from the resource drop down menu.
6. Select Write Access Events from the Log Category drop down menu.
7. Type a name for your Object Storage write log in the Log Name drop down menu.
8. Click the Enable Log button in the lower left hand corner.

From CLI

First, if a log group for holding these logs has not already been created, create a log group by the following steps:

1. Create a log group:

oci logging log-group create --compartment-id <compartment-id> \ --display-name "<DisplayName>" \ --description "<Description>"

The output of the command gives you a work request id. You can query the work request to see the status of the job by issuing the following command:

oci logging work-request get --work-request-id <output from command above>

Look for status filed to be SUCCEEDED.

Second, enable Object Storage write log logging for your bucket(s) by the following steps:

2. Get the Log group ID needed for creating the Log:

oci logging log-group list --compartment-id <compartment-id> \ --query 'data[?contains("display-name", `'"<DisplayName>"'`)].id|join(`\n`, @)' \ --raw-output

3. Create a JSON file called config.json with the following content:

{
  "compartmentid":"ocid1.compartment.oc1..aaaaaaaamaywlaznovmvdwk3uqx2sedfavssagba5cxufe6wy llqgwzcq43a",
  "source": {
    "resource": "<bucket-name.",
    "service": "ObjectStorage",
    "source-type": "OCISERVICE",
    "category": "write"
  }
}

The compartment-id is the Compartment OCID of where the bucket is exists. The resource value is the bucket name.

4. Create the Service Log:

oci logging log create --log-group-id <value from step 2.> \ --display-name "<DisplayName>" \ --log-type SERVICE --is-enabled TRUE \ --configuration file://config.json

The output of the command gives you a work request id. You can query the work request to see that status of the job by issuing the following command:

oci logging work-request get --work-request-id <output from command above>

Look for the status filed to be SUCCEEDED.