From 5c853f08c03c9dc9792359f2dc8e8d8d4740af2d Mon Sep 17 00:00:00 2001 From: johnlakeee Date: Wed, 8 Jul 2026 11:22:11 -0400 Subject: [PATCH] Update variables.tf Added the logging_bucket_retention variable defaulting to 365 (1 year) to meet regulatory requirements out-of-the-box (e.g. NIST AU-9). Updated the description of the log_sinks variable to reference the new 365-day default retention period. --- fast/stages-aw/0-bootstrap/variables.tf | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/fast/stages-aw/0-bootstrap/variables.tf b/fast/stages-aw/0-bootstrap/variables.tf index 30e051e54..2450b9291 100644 --- a/fast/stages-aw/0-bootstrap/variables.tf +++ b/fast/stages-aw/0-bootstrap/variables.tf @@ -209,7 +209,7 @@ variable "locations" { # for additional logging filter examples variable "log_sinks" { - description = "Org-level log sinks, in name => {type, filter} format." + description = "Org-level log sinks, in name => {type, filter} format. Valid types: 'logging' (routes to Cloud Logging bucket with 365-day default retention), 'pubsub' (routes to Pub/Sub topic with 7-day default retention; requires an active consumer to avoid log loss), 'storage' (routes to GCS bucket), 'bigquery' (routes to BigQuery dataset)." type = map(object({ filter = string type = string @@ -249,6 +249,12 @@ variable "logging_kms_key" { default = null } +variable "logging_bucket_retention" { + description = "Retention period (in days) for the Cloud Logging buckets created for organization log exports." + type = number + default = 365 +} + variable "org_policies_config" { description = "Organization policies customization." type = object({