Check ID:
Provider: GCP
Service:
Severity: HIGH
Categories:
Resource type:
cloudstorage_bucket_log_retention_policy_lockProvider: GCP
Service:
cloudstorageSeverity: HIGH
Categories:
logging, forensics-readyResource type:
storage.googleapis.com/BucketWhat this check verifies
Cloud Storage log sink buckets have a configured retention period with Bucket Lock applied, ensuring the retention policy cannot be shortened or removed.Risk
Without a locked retention policy, exported logs can be deleted early or retention reduced, undermining log integrity and availability. An attacker or malicious insider could purge evidence to evade detection, hindering forensics and weakening non-repudiation across the environment.Recommendation
Set a retention policy on every log sink bucket and enable Bucket Lock. Choose durations that meet investigative and regulatory needs. Enforce least privilege and separation of duties for bucket and logging administration, and apply defense in depth so no single actor can weaken log retention.Remediation
- CLI
- Terraform
- Dashboard steps
gcloud storage buckets lock-retention-policy gs://<LOG_BUCKET_NAME>
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudStorage/retention-policies-with-bucket-lock.html
- https://docs.cloud.google.com/storage/docs/bucket-lock
- https://docs.cloud.google.com/storage/docs/using-bucket-lock
- https://docs.cloud.google.com/storage/docs/samples/storage-lock-retention-policy
- https://docs.cloud.google.com/logging/docs/export/configure_export_v2
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = cloudstorage_bucket_log_retention_policy_lock. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks