Alibaba Cloud OSS bucket has access logging enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_ALI_12
Category - Subcategory	Logging - Under Use
Provider	ALIBABA_CLOUD
Severity	LOW
Framework	Terraform

Impact

This rule identifies Alibaba Cloud Object Storage Service (OSS) buckets that do not have logging enabled.

Enabling logging for OSS buckets helps capture access and operation events, which are critical for security monitoring, troubleshooting, and auditing. Without logging, you lack visibility into who accesses and interacts with your bucket, potentially missing unauthorized access or suspicious behaviour.

As a security best practice, it is recommended to enable logging for OSS buckets.

How to Fix

Resource: alicloud_oss_bucket

• Arguments: logging

To mitigate this issue, ensure the logging attribute in the alicloud_oss_bucket resource is configured.

Example: [source,go]

resource "alicloud_oss_bucket" "example" { ...

• logging {
• target_bucket = "my-log-bucket"
• target_prefix = "log/"
• } }

---