Object Storage bucket has write-level logging enabled

Check ID: objectstorage_bucket_logging_enabled
Provider: Oracle Cloud (OCI)
Service: objectstorage
Severity: MEDIUM
Categories: logging
Resource type: Bucket

What this check verifies

OCI Object Storage buckets have service logs for write access events enabled. The evaluation identifies buckets with an active write logging category scoped to the bucket and region; only read logging does not satisfy this condition.

Risk

Without write logging, unauthorized or accidental overwrites and deletions can go undetected, degrading data integrity and availability. Missing audit evidence weakens non-repudiation, impedes incident response, and allows covert tampering without reliable forensic reconstruction.

Recommendation

Enable write service logs on all buckets and route them to a centralized log group for monitoring. Apply least privilege to log data, enforce retention and immutability, and alert on anomalous write activity. Use defense in depth so bucket changes are accountable and swiftly detected.

Remediation

CLI
Terraform
Dashboard steps

oci logging log create --log-group-id <log-group-ocid> --display-name ObjectStorage-Write-Logs --log-type SERVICE --configuration '{"compartmentId":"<compartment-ocid>","source":{"service":"objectstorage","resource":"<bucket-name>","category":"write","sourceType":"OCISERVICE"}}'

resource "oci_logging_log" "<example_resource_name>" {
  display_name = "ObjectStorage-Write-Logs"
  log_group_id = "<example_resource_id>"
  log_type     = "SERVICE"

  configuration {
    compartment_id = "<example_resource_id>"
    source {
      service     = "objectstorage"          # Critical: Service must be Object Storage
      category    = "write"                   # Critical: Enable write-level logging
      resource    = "<example_resource_name>" # Critical: Bucket name must match the target bucket
      source_type = "OCISERVICE"
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = objectstorage_bucket_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Object Storage bucket uses a customer-managed key Object Storage bucket is not publicly accessible

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires