Audit logs are enabled and retained for minimum 90 days

PCI-DSS 4.0 Req 10.5 requires audit logs to be retained for at least 12 months, with at least 3 months immediately available; Req 10.2 requires specific event types to be logged. Logs retained for only 7 or 30 days mean that a breach discovered 60 days after the intrusion has no forensic record — you cannot determine how much data was taken, when, or by whom. SOC 2 CC7.2 and ISO 27001:2022 A.8.15 both require log availability for incident investigation. NIST AU-11 sets the retention baseline. Short-retention configurations that are left at default (often 7 days for CloudWatch) are a routine PCI audit failure.

Set retention_in_days = 365 on every CloudWatch log group that receives CDE-related events. The default (never expire) is acceptable but explicit 365-day retention signals compliance intent to an auditor. For cost management, archive logs older than 90 days to S3 — they still count as immediately available per Req 10.5 if retrieval takes under 24 hours.

resource "aws_cloudwatch_log_group" "cde_audit" {
  name              = "/cde/audit"
  retention_in_days = 365
  tags = { compliance = "pci-dss" }
}

Enable pgaudit on PostgreSQL to capture DDL, DML, and ROLE events at the database layer. Reference the retention configuration in docs/pci-compliance.md under the Audit & Logging section so the audit trail to Req 10.5 is explicit.