Control: 2.14 Ensure log monitoring and alerts are set up for OSS permission changes

Description

It is recommended that a metric filter and alarm be established for OSS Bucket RAM changes.

Remediation

Perform the following to ensure the log monitoring and alerts are set up for OSS permission changes:

From Console

1. Logon to SLS Console.
2. Click Log Service Audit Service in the navigation pane.
3. Go to Access to Cloud Products > Global Configuration page.
   • Select a location of project for logs.
   • Check the OSS and configure a proper days.
   • Click Save to save the changes.
4. Go to Access to Cloud Products > Global Configurations click Central Project.
5. Select Log Management > OSS Log.
6. In the search/analytics console, input below query

(operation: PutBucket and request_uri: acl) or operation: PutObjectAcl| select bucket, count (1) as c group by bucket

7. Create a dashboard and set alert for the query result.