Skip to content

Update ddg.md #130

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
woodham1 merged 2 commits into from
Jul 20, 2026
Merged

Update ddg.md #130

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
227281e
Update ddg.md
johnlakeee Jul 8, 2026
a64022e
Merge branch 'main' into johnlakeee-patch-10
johnlakeee Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/ddg.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -525,8 +525,8 @@ single region storage bucket, or vice versa).
The audit project (`audit-logs-0`) is created to centralize organization-level logs. By default, audit logs are routed to CMEK-encrypted Cloud Logging buckets within this project (`type = "logging"`).

#### Audit Log Retention
- **Cloud Logging Buckets (Default):** The default retention for Cloud Logging buckets created in this stage is **30 days**. While 30 days is longer than the few days provided by Pub/Sub, it is still a limited window if your Security Information and Event Management (SIEM) integration or long-term archiving solutions are not fully established.
- **Adjusting Retention:** If you require longer log retention for compliance or auditing before SIEM integration, you can change the routing type to `storage` (for GCS buckets) or configure custom retention settings.
- **Cloud Logging Buckets (Default):** The default retention for Cloud Logging buckets created in this stage is **365 days** (1 year) to comply with regulatory standards (e.g. NIST 800-53 AU-9 requirements).
- **Adjusting Retention:** If you require a different retention period, configure the `logging_bucket_retention` variable in Stage 0. If you require long-term archival or external analytical processing, you can change the routing type to `storage` (for GCS buckets) or `bigquery` (for BigQuery dataset).

#### Transitioning to Pub/Sub Routing (SIEM Integration)
To stream logs to an external SIEM or analytical platform, you can configure your log sinks to route to Pub/Sub (`type = "pubsub"`).
Expand Down