How can we ensure that the logs have not been altered?

Grafana Loki
1

Hello,

I am considering using S3 Object Locking to ensure that logs are not deleted or tampered with. Here are my questions:

Can we set a retention period for S3 Object Locking and proceed this way?
How can we ensure that the logs have not been altered? Is there any method or tool that can provide this guarantee?

Looking forward to your feedback. Thank you.

2

Why you don’t enable AWS S3 versioning? = any change can be detected by chwxkng version + you can still restore previous version.

3

Loki is not going to change the logs that have been written. What exactly are you concerned about? If you are worried about someone manually tinkering with your Loki S3 storage then it would be much more productive to try and lock down the S3 bucket with access permission and policy.

In terms of retention, as @jangaraj pointed out you should want to enable versioning. Here is our S3 bucket lifecycle policy for our production Loki cluster:

  1. Expire current object after 360 days (object becomes versioned).
  2. Permenantly delete versioned object after 30 days.

This gives you a 30-day window to recover any object that’s altered or deleted.