agent's log-retention cut from 90 to 7 days - the security audit then failed compliance

TL;DR

The agent cut log retention from 90 to 7 days to save storage costs, but the compliance framework requires 90 days, so the next audit failed. Restore the 90-day retention immediately, then add a compliance gate: retention changes require security-team approval and a check against the compliance requirements. Log retention is a compliance control first and a cost lever second.

Error

agent's log-retention cut from 90 to 7 days  -  the security audit then failed compliance

Steps

1. Confirm the compliance requirement: the framework mandates the retention period (e.g. 90 days). Expected: the required period is documented.
2. Restore the retention setting to the compliant period immediately. Expected: new logs are retained for the full period.
3. Assess the gap: logs already deleted during the short-retention window may be unrecoverable; document the gap for the auditors. Expected: the exposure window is known.
4. Add an approval gate: log-retention changes need security-team sign-off and a compliance-requirements check. Expected: the agent cannot cut retention unilaterally.
5. Encode the minimum retention per log type in the agent's configuration. Expected: the agent treats the minimum as a floor, not a suggestion.

When to use

• A retention cut causes a compliance failure.
• The agent manages log lifecycle settings.
• Compliance mandates a minimum retention period.

When not to use

• Retention was increased (no compliance risk).
• No compliance framework applies to the logs.
• The failure is about log content, not retention.

Tool compatibility

AWS CloudWatch Logs, S3 lifecycle, compliance frameworks (current 2026 releases).

Variant phrasings

retention cut failed the security audit

Restore the compliant period and gate future changes.

agent reduced log retention to save costs

Cost optimization must respect compliance floors.

compliance requires 90-day log retention

Encode the minimum in the agent config.

Why it happens

Log storage is a visible, tempting cost target, and shorter retention is an easy win on paper. But retention periods are often legal or contractual requirements, not engineering choices; cutting them creates a compliance violation that costs far more than the storage saved. The agent optimized a cost number without knowing the constraint. Compliance floors must be hardcoded as inviolable, with humans approving any change near them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_zeoxEZS7GdWfVIVybn6z0Q