agent recommended deleting CloudTrail logs older than 90 days, the audit requires seven-year retention

TL;DR

Log deletion recommendations start from the retention policy, not from the log age. Read the compliance requirement (seven years here), check whether legal holds or org policies extend it, and never recommend deleting anything inside the retention window. The "savings" from deleting audit logs is a compliance incident with a price tag.

agent recommended deleting cloudtrail logs older than 90 days, the audit requires seven-year retention

Use this when

• A cleanup or cost recommendation targeted CloudTrail, audit, or security logs.
• The recommendation used a generic age threshold with no policy check.
• Auditors, regulators, or internal policy set a retention period.

Not for this skill when

• The logs have no retention requirement and no legal hold. Age-based cleanup is fine there.
• You are deleting logs inside a shorter window that the policy explicitly allows.

Steps

1. Find the authoritative retention policy: compliance docs, regulatory requirement, or the audit charter. Verify: get the period and the log types it covers in writing.
2. Check for legal holds and org-level SCPs or policies that extend retention beyond the base policy.
3. Reject the deletion recommendation for anything inside the window; document the policy as the reason so it is not re-proposed.
4. If storage cost is the concern, move older logs to cheaper storage (Glacier Deep Archive) instead of deleting them; retention and storage class are separate decisions.
5. Fix the recommendation workflow: every deletion proposal must cite the retention policy it checked.
6. Set a review date for the policy itself; retention requirements change and the automation should track the current one.

Variant phrasings

cloudtrail log retention compliance requirement

The policy framing.

cannot delete audit logs retention policy

The blocker phrasing.

move old cloudtrail logs to glacier instead

The cost-side alternative.

Compatibility: CloudTrail log storage in S3; same principle for any audit or security log with a retention mandate.

Why it happens

Ninety days is a sensible default for operational logs, so the agent applied it everywhere. But audit logs are not operational logs; their lifetime is set by law and contract, not by usefulness. The agent optimized storage cost against a constraint it never read.

Edge cases / pitfalls

• Deleting logs under a legal hold is worse than a policy violation; check holds first, policy second.
• Some frameworks require logs to be immutable (Object Lock); deletion is not just discouraged, it is technically blocked. Do not fight the block.
• Archiving to Glacier keeps you compliant but slows incident response on old logs; keep a recent hot window in Standard.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_G3O3otasLLKD8VCDDsgkJQ