An ApsaraDB for Redis instance is evaluated as Compliant if audit logging is enabled and the log retention period meets or exceeds the specified value.
Scenarios
Use this rule to ensure that ApsaraDB for Redis instances retain audit logs for a period that meets your security and regulatory requirements.
Risk level
Default risk level: medium.
You can change the risk level to suit your business requirements.
Compliance evaluation logic
- If audit logging is enabled for an ApsaraDB for Redis instance and the log retention period meets or exceeds the specified value, the evaluation result is Compliant.
- If audit logging is disabled for an ApsaraDB for Redis instance, the evaluation result is Incompliant. If the log retention period is less than the specified value, the evaluation result is also Incompliant. For more information about how to remediate an incompliant configuration, see Incompliance remediation.
Rule details
| Item | Description |
| Rule name | redis-instance-audit-log-retention |
| Rule identifier | redis-instance-audit-log-retention |
| Tag | Redis and AuditBaseline |
| Automatic remediation | Supported |
| Trigger type | Periodic execution |
| Evaluation frequency | Interval of 24 hours |
| Supported resource type | ApsaraDB for Redis instance |
| Input parameter | days. Default value: 180. Unit: days. |
Incompliance remediation
Enable audit logging for an ApsaraDB for Redis instance and set a log retention period. For more information, see Audit logs.