search

aws-ia / terraform-aws-control_tower_account_factory

AWS Control Tower Account Factory
Apache License 2.0
604 stars 386 forks source link

Apply log_archive_bucket_object_expiration_days to current versions as well #434

Open markvankessel opened 4 months ago

markvankessel commented 4 months ago

I would like all object in the log archive bucket, current or non-current, to expire after a configurable time. Since 1.12.0 it is possible to configure log_archive_bucket_object_expiration_days but this only applies to non-current versions.

For compliancy reasons, we need to ensure log archives are stored no more and no less then a defined number of years. Right now, the Cloud Trail created by AFT stores its logs indefinitely, even if you configure log_archive_bucket_object_expiration_days, because the S3 lifecycle rule only applies to noncurrent_version_expiration and CloudTrail does not actually update objects. See s3.tf.

I would propose to apply log_archive_bucket_object_expiration_days to expiration as well.

hanafya commented 4 months ago

Hey @markvankessel! Thank you for bringing this to our attention! I have created an item in our backlog to review this request!