CERT-In log retention on AWS: keeping 180 days of logs and reporting within 6 hours

The Directions (No. 20(3)/2022-CERT-In, dated 28 April 2022) set six obligations. Four matter for most AWS workloads: synchronise ICT system clocks to NTP servers of NIC or NPL, or to a time source that does not deviate from them; report incidents of the types listed in Annexure I within 6 hours; designate a Point of Contact to interface with CERT-In, using the Annexure II format; and enable logs of all ICT systems, keep them securely for a rolling 180 days within Indian jurisdiction, and provide them with an incident report or when CERT-In directs.

Annexure I lists 20 incident categories, including unauthorised access to IT systems or data, data breach, data leak, malicious code such as ransomware, and attacks or malicious or suspicious activities affecting cloud computing systems. The remaining two obligations — subscriber records for data centre, VPS, cloud and VPN providers, and KYC records for virtual asset providers — apply to those specific provider types.

Copies outside India: CERT-In’s FAQ (May 2022, Q35) says logs may be stored outside India also, as long as the obligation to produce logs to CERT-In is met in a reasonable time. Q36 adds that a service provider offering services to users in India needs to enable and maintain logs in Indian jurisdiction. The simpler pattern on AWS is to keep the primary 180-day archive in ap-south-1 or ap-south-2 and treat any copy elsewhere as additional.

Which logs: Q37 gives a non-exhaustive list — firewall, intrusion prevention, SIEM, web, database, mail, FTP, proxy, event logs of critical systems, application, SSH and VPN logs — and says both successful and unsuccessful events should be recorded.

Incomplete details: under Q30, entities may report the information available within 6 hours and send additional information later within reasonable time. Q13 says the entity that notices an incident must report it; the obligation is not transferable to a partner.

Clocks: Q40 says system clocks do not have to be set to IST, but time zone should be recorded with the time. Q42 says entities relying on a cloud provider’s native time service may continue to use it.

CloudTrail Event history holds the past 90 days of management events per Region. For a longer record you need a trail delivering to S3. CloudTrail Lake has been closed to new customers since 31 May 2026, so plan on trails to S3 rather than a new Lake event data store.

CloudWatch Logs keeps log events indefinitely unless you set a retention policy; valid settings include 180 and 365 days, and deletion can take up to 72 hours after the retention date. GuardDuty retains findings for 90 days and can export them to S3. Security Hub CSPM deletes active findings that have not been updated for 90 days and archived findings after 30 days; AWS suggests EventBridge to S3 for longer retention. VPC Flow Logs can be published to CloudWatch Logs, S3 or Amazon Data Firehose — choose an India destination.

Use this map to review an AWS environment against each requirement. It is a configuration checklist, not a compliance certificate.

Start with a central log archive: a dedicated log archive account and an S3 bucket in ap-south-1 or ap-south-2, receiving an organisation CloudTrail trail with management events, plus data events where your risk needs them. Keep logs at least 180 days with S3 Lifecycle rules, and use S3 Object Lock. In compliance mode no user, including the root user, can overwrite or delete a locked object version until its retention date; governance mode lets specifically permitted users make exceptions. Choose the mode deliberately.

Then set CloudWatch Logs retention to 180 days or more on every log group that holds security-relevant data, turn on network and edge logs with India destinations, and export GuardDuty and Security Hub CSPM findings to S3 so incident evidence outlives the 90-day service windows.

Decide in advance who declares an incident noticed, who files with CERT-In and which AWS logs you pull first. Work through these steps in order.

The gaps below are frequent in AWS setups and in public guidance on this topic.

For India residency design beyond logs, see the AWS data residency and DPDP guide. For metrics, alarms and dashboards, see the AWS-native observability baseline. For backup copies across Mumbai and Hyderabad, see the AWS Backup and DR guide. Banks regulated by the RBI also have the RBI Cybersecurity Directions, 2026; see our RBI control map for AWS.

Upvantix is an AWS Select Tier Services Partner. We help India mid-market teams review their AWS logging setup against the CERT-In Directions, close gaps in retention and findings export, and plan an incident-reporting runbook. Upvantix is not CERT-In, is not a CERT-In empanelled auditor and does not give legal opinions.

This guide summarises public CERT-In and AWS documents as of 9 October 2026. It is general information, not legal advice. Requirements and AWS features change; confirm your obligations with your legal and compliance advisers.