Small activity log retention period This product is not supported for your selected
Datadog site . (
).
Id: terraform-azure-small-activity-log-retention-period
Provider: Azure
Platform: Terraform
Severity: Low
Category: Observability
Learn More Description This check ensures that the retention_policy.days attribute for the azurerm_monitor_log_profile resource in Terraform is set to 365 days or greater. Insufficient log retention (for example, days = 7 or leaving the value unset) can result in the loss of valuable activity logs, limiting the ability to investigate incidents or meet audit requirements. To address this, configure the retention policy to at least 365 days, as shown below:
retention_policy {
enabled = true
days = 367
}
Compliant Code Examples resource "azurerm_monitor_log_profile" "negative1" {
name = "default"
categories = [
"Action" ,
"Delete" ,
"Write" ,
]
locations = [
"westus" ,
"global" ,
]
servicebus_rule_id = " ${ azurerm_eventhub_namespace . example . id } /authorizationrules/RootManageSharedAccessKey"
storage_account_id = azurerm_storage_account . example . id
retention_policy {
enabled = true
days = 367
}
}
resource "azurerm_monitor_log_profile" "negative2" {
name = "default"
categories = [
"Action" ,
"Delete" ,
"Write" ,
]
locations = [
"westus" ,
"global" ,
]
servicebus_rule_id = " ${ azurerm_eventhub_namespace . example . id } /authorizationrules/RootManageSharedAccessKey"
storage_account_id = azurerm_storage_account . example . id
retention_policy {
enabled = true
days = 0
}
}
Non-Compliant Code Examples resource "azurerm_monitor_log_profile" "positive1" {
name = "default"
categories = [
"Action" ,
"Delete" ,
"Write" ,
]
locations = [
"westus" ,
"global" ,
]
servicebus_rule_id = " ${ azurerm_eventhub_namespace . example . id } /authorizationrules/RootManageSharedAccessKey"
storage_account_id = azurerm_storage_account . example . id
retention_policy {
enabled = true
days = 7
}
}
resource "azurerm_monitor_log_profile" "positive2" {
name = "default"
categories = [
"Action" ,
"Delete" ,
"Write" ,
]
locations = [
"westus" ,
"global" ,
]
servicebus_rule_id = " ${ azurerm_eventhub_namespace . example . id } /authorizationrules/RootManageSharedAccessKey"
storage_account_id = azurerm_storage_account . example . id
retention_policy {
enabled = true
}
}
resource "azurerm_monitor_log_profile" "positive3" {
name = "default"
categories = [
"Action" ,
"Delete" ,
"Write" ,
]
locations = [
"westus" ,
"global" ,
]
servicebus_rule_id = " ${ azurerm_eventhub_namespace . example . id } /authorizationrules/RootManageSharedAccessKey"
storage_account_id = azurerm_storage_account . example . id
retention_policy {
enabled = false
}
}
