Log centralization and integrity verification is implemented

PCI-DSS 4.0 Req 10.3 requires that audit logs are protected from destruction and unauthorized modifications; Req 10.4 mandates that log content is reviewed at least once daily. Logs stored only on the same server they monitor can be deleted by an attacker to cover their tracks. CWE-778 (Insufficient Logging) combined with writable log storage means a compromised host can silence its own forensic record. NIST AU-9 requires protection of audit information. S3 Object Lock (WORM) combined with KMS encryption satisfies Req 10.3 — an attacker with application-level access cannot delete an Object Lock-protected log archive.

Forward logs from at least two sources (application, database) to a centralized log group, then export to an S3 bucket with Object Lock enabled so logs are write-once and cannot be deleted. Encrypt the archive with a KMS key that is managed separately from the CDE application credentials.

resource "aws_s3_bucket_object_lock_configuration" "log_archive" {
  bucket = aws_s3_bucket.log_archive.id
  rule {
    default_retention {
      mode = "GOVERNANCE"
      days = 365
    }
  }
}

Add a CloudWatch Subscription Filter to stream CDE log groups into the central archive log group. Document the centralization topology in docs/pci-compliance.md — a QSA will ask to see how Req 10.3 tamper protection is implemented.