# How long audit records are kept, how much space they occupy, and whether the pipeline that delivers them is currently failing — retention settings on every log group and log bucket, the storage they consume, and the trail's own delivery-error fields

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/audit-log-retention-and-delivery-failure

Recipe id: `audit-log-retention-and-delivery-failure` · cadence daily · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-MLA-OSM`
- control `au-4`
- control `au-5`
- control `au-11`

## Collection

Kind: `cli`

```sh
# describe-log-groups
aws logs describe-log-groups --query 'logGroups[].{Group:logGroupName,RetentionDays:retentionInDays,StoredBytes:storedBytes,Class:logGroupClass}'
# cw-loggroup-retention-period-check
aws configservice get-compliance-details-by-config-rule --config-rule-name cw-loggroup-retention-period-check --compliance-types NON_COMPLIANT
# get-bucket-lifecycle-configuration
aws s3api get-bucket-lifecycle-configuration --bucket <LOG_BUCKET>
# s3-lifecycle-policy-check
aws configservice get-compliance-details-by-config-rule --config-rule-name s3-lifecycle-policy-check --compliance-types NON_COMPLIANT
# get-metric-statistics
aws cloudwatch get-metric-statistics --namespace AWS/S3 --metric-name BucketSizeBytes --dimensions Name=BucketName,Value=<LOG_BUCKET> Name=StorageType,Value=StandardStorage --start-time <START_TIME> --end-time <END_TIME> --period 86400 --statistics Average
# get-trail-status
aws cloudtrail get-trail-status --name <TRAIL_NAME> --query '{Logging:IsLogging,LastDelivery:LatestDeliveryTime,DeliveryError:LatestDeliveryError,DigestDelivery:LatestDigestDeliveryTime,DigestError:LatestDigestDeliveryError,NotificationError:LatestNotificationError}'
# cloud-trail-cloud-watch-logs-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-cloud-watch-logs-enabled --compliance-types NON_COMPLIANT
```

## Expected output

A log-group list in which every group carries the retentionInDays your policy requires and a storedBytes you can trend — a group with no retentionInDays at all never expires; an empty NON_COMPLIANT set from the retention rule, meaning no group falls below MinRetentionTime (default 365 days); a Rules array on the log bucket with an Enabled rule whose Transitions and Expiration match your archive and deletion policy, or a NoSuchLifecycleConfiguration error if none is set; a daily BucketSizeBytes series showing the log store's growth curve against whatever headroom you provisioned; and a trail status with IsLogging true, a LatestDeliveryTime within the last few minutes, and LatestDeliveryError, LatestDigestDeliveryError and LatestNotificationError all absent — a populated error field is the audit-logging-process failure AU-05 is about. Managed rule identifiers: CW_LOGGROUP_RETENTION_PERIOD_CHECK, S3_LIFECYCLE_POLICY_CHECK, CLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLED

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

CloudWatch Logs, Amazon S3, CloudTrail, AWS Config and CloudWatch metrics are all available in AWS GovCloud (US); log-group, bucket and trail ARNs use partition arn:aws-us-gov

## Notes

This is the capacity and durability of the audit pipeline, not proof that it is adequate. AU-04 asks that storage capacity be sufficient for your defined requirement — S3 has no fixed ceiling to report, so the honest evidence is the consumption trend plus the retention and lifecycle settings that bound it, and the judgement that the headroom is enough stays yours. AU-05 is answered here only in its detection half: get-trail-status surfaces the delivery failure, and the alerting and the real-time response — notify these people, shut down or overwrite oldest records — is process, with the alarm-side telemetry living in the AU-06 log-review recipe (CLOUDWATCH_ALARM_ACTION_CHECK). AU-11 is the retention setting, which these commands read directly, but conformance to your record-retention period is a comparison against policy: note that cw-loggroup-retention-period-check marks a Never-expire group COMPLIANT, so an unbounded group passes the rule while potentially violating a maximum-retention or data-disposal requirement — read the raw retentionInDays, not just the rule verdict. Substitute your real bucket, trail and window; run get-trail-status per trail (it is a single-trail call) and against the trail's home Region. BucketSizeBytes is a once-daily storage metric and CloudWatch metric delivery is best-effort, so a missing data point is not by itself an incident. Pass expectedDeliveryWindowAge to cloud-trail-cloud-watch-logs-enabled if you want the rule to fail on stale delivery rather than only on an unconfigured CloudWatch Logs destination; the trail's existence, integrity and encryption are the AU-02/03/09/12 recipe's job.

## References

- {"title":"AWS CLI: logs describe-log-groups (retentionInDays, storedBytes, logGroupClass)","url":"https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html"}
- {"title":"AWS Config managed rule: cw-loggroup-retention-period-check","url":"https://docs.aws.amazon.com/config/latest/developerguide/cw-loggroup-retention-period-check.html"}
- {"title":"AWS CLI: s3api get-bucket-lifecycle-configuration","url":"https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-lifecycle-configuration.html"}
- {"title":"AWS Config managed rule: s3-lifecycle-policy-check","url":"https://docs.aws.amazon.com/config/latest/developerguide/s3-lifecycle-policy-check.html"}
- {"title":"Amazon S3 CloudWatch metrics and dimensions (BucketSizeBytes, daily storage metrics)","url":"https://docs.aws.amazon.com/AmazonS3/latest/userguide/metrics-dimensions.html"}
- {"title":"AWS CLI: cloudtrail get-trail-status (LatestDeliveryError, LatestDigestDeliveryError)","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/get-trail-status.html"}
- {"title":"AWS Config managed rule: cloud-trail-cloud-watch-logs-enabled (expectedDeliveryWindowAge)","url":"https://docs.aws.amazon.com/config/latest/developerguide/cloud-trail-cloud-watch-logs-enabled.html"}