Policy: GCP > CIS v3.0 > 2 - Logging and Monitoring > 2.03 - Ensure That Retention Policies on Cloud Storage Buckets Used for Exporting Logs Are Configured Using Bucket Lock

Configures auditing against a CIS Benchmark item.

Level: 2

Enabling retention policies on log buckets will protect logs stored in cloud storage buckets from being overwritten or accidentally deleted. It is recommended to set up retention policies and configure Bucket Lock on all storage buckets that are used as log sinks.

Targets

This policy targets the following resource types:

GCP > Storage > Bucket

Primary Policy

This policy is used with the following primary policy:

GCP > CIS v3.0 > 2 - Logging and Monitoring

Controls

Setting this policy configures this control:

GCP > CIS v3.0 > 2 - Logging and Monitoring > 2.03 - Ensure That Retention Policies on Cloud Storage Buckets Used for Exporting Logs Are Configured Using Bucket Lock

Policy Specification

Schema Type	`string`
Default	`Per GCP > CIS v3.0 > 2 - Logging and Monitoring`
Valid Values [YAML]	`Per GCP > CIS v3.0 > 2 - Logging and Monitoring` `Skip` `Check: Benchmark`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/cis#/control/categories/v071406

Policy Type URI

tmod:@turbot/gcp-cisv3-0#/policy/types/r0203

GraphQL

query policyType(id: "tmod:@turbot/gcp-cisv3-0#/policy/types/r0203") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/gcp-cisv3-0#/policy/types/r0203'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/gcp-cisv3-0#/policy/types/r0203'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/gcp-cisv3-0#/policy/types/r0203"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/gcp-cisv3-0#/policy/types/r0203"