AU-4—Audit Log Storage Capacity
LI-SaaS
Low
Moderate
High
>Control Description
Allocate audit log storage capacity to accommodate ⚙organization-defined audit log retention requirements.
>FedRAMP Baseline Requirements
No FedRAMP-specific parameter values or requirements for this baseline.
>Discussion
Organizations consider the types of audit logging to be performed and the audit log processing requirements when allocating audit log storage capacity. Allocating sufficient audit log storage capacity reduces the likelihood of such capacity being exceeded and resulting in the potential loss or reduction of audit logging capability.
>Cross-Framework Mappings
>Programmatic Queries
Beta
Related Services
CloudWatch Logs
S3
Kinesis Data Firehose
CLI Commands
Check log group storage metrics
aws cloudwatch get-metric-statistics --namespace AWS/Logs --metric-name IncomingBytes --dimensions Name=LogGroupName,Value=LOG_GROUP --start-time $(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ) --end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) --period 86400 --statistics SumCheck S3 bucket size for logs
aws s3 ls s3://BUCKET_NAME --recursive --summarize | tail -2List log group stored bytes
aws logs describe-log-groups --query 'logGroups[*].{Name:logGroupName,StoredBytes:storedBytes}'Check CloudTrail S3 bucket
aws cloudtrail describe-trails --query 'trailList[*].{Name:Name,S3Bucket:S3BucketName}'>Relevant Technologies
Technology-specific guidance with authoritative sources and verification commands.
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What formal policies and procedures govern the implementation of AU-4 (Audit Log Storage Capacity)?
- •Who are the designated roles responsible for implementing, maintaining, and monitoring AU-4?
- •How frequently is the AU-4 policy reviewed and updated, and what triggers policy changes?
- •What training or awareness programs ensure personnel understand their responsibilities related to AU-4?
Technical Implementation:
- •Describe the specific technical mechanisms or controls used to enforce AU-4 requirements.
- •What automated tools, systems, or technologies are deployed to implement AU-4?
- •How is AU-4 integrated into your system architecture and overall security posture?
- •What configuration settings, parameters, or technical specifications enforce AU-4 requirements?
Evidence & Documentation:
- •What documentation demonstrates the complete implementation of AU-4?
- •What audit logs, records, reports, or monitoring data validate AU-4 compliance?
- •Can you provide evidence of periodic reviews, assessments, or testing of AU-4 effectiveness?
- •What artifacts would you present during a FedRAMP assessment to demonstrate AU-4 compliance?
Ask AI
Configure your API key to use AI features.