Audit Log Retention Lint (PCI DSS, CERT-In)

Your log pipeline is written in YAML, and the number that decides whether your audit trail survives an assessment is one line in it: retention_period: 744h, RetentionInDays: 30, --audit-log-maxage=30. This extension reads those lines in the file you have open and tells you, with the line number, which ones delete logs sooner than the rule you are held to.

Tool page: https://getreadystack.com/tools/audit-log-retention-lint

What it checks (9 rules)

Durations are read the way the tools read them: 744h is 31 days, 8760h is 365 days, 90d, 2w and 1y all work, plain integers are days.

Which rule applies

Put one comment line at the top of the file. Without it the extension uses PCI DSS.

# log-retention: pci-dss, cert-in

When several profiles are listed, the strictest minimum wins for each check.

Example

The sample file _fixtures/dirty.yaml (Loki, CloudFormation, S3, kube-apiserver and ILM in one file) returns 7 findings under PCI DSS: 6 errors and 1 warning. Loki retention_period: 744h is 31 days against 365; the payments stream override period: 168h is 7 days; RetentionInDays: 30; an S3 audit bucket that moves logs to GLACIER after 30 days and deletes them after 180; --audit-log-maxage=30; and an ILM delete phase at min_age: 90d. The fixed file returns 0.

What is free and what needs a key

Free, no key: every finding in the open file, in the Problems panel, with the clause and the value that passes. The same engine runs in the browser at the tool page.

With a licence key: the workspace sweep, which walks every YAML file in the folder and writes one Markdown evidence table (file, line, value, minimum, clause) you can hand to a QSA or an auditor. Licence key · $29 once · one licence key per person or team seat.

Yardstick: one hour of a lawyer with 15 years' experience is $851 on the DOJ Fitzpatrick Matrix (billing year 2026).

Limits

The extension reads configuration text. It does not query your cloud account, so a retention changed in a console after deploy is not seen. It does not decide whether a system is in PCI scope. It does not know about retention set in Terraform HCL or JSON policies unless they are in a YAML file.

Commands

• Check this file
• Sweep workspace and write report (licence)
• Enter licence key