[OCI] Audit log retention check fails with 404 error due to incorrect API path/endpoint

[stonehenjii]

Issue search

• I have searched the existing issues and this bug has not been reported yet

Which component is affected?

Prowler API

Cloud Provider (if applicable)

Not applicable

Steps to Reproduce

I am encountering a FAILED result for the check: Tenancy audit log retention period is 365 days or greater. Upon checking the Prowler logs, it appears that Prowler is attempting to call an incorrect OCI API endpoint, resulting in a 404 Not Found error. This causes the check to fail even when the actual OCI configuration is set correctly (365 days or more).

To Reproduce:

1. Run Prowler against an OCI environment.

2. Observe the check: audit_log_retention_period_365_days.

3. Check the debug logs to see the API request path.

4. Prowler hits a non-existent path/endpoint, returning a 404 error.

Expected behavior

Prowler should correctly call the Audit Configuration API (e.g., GET /audit/configuration) using the valid regional endpoint or the home region to retrieve the retention-period-days value.

Actual Result with Screenshots or Logs

I use Prowler opensource on enterprise environment, so I couldn't offer result with screenshots or Logs.

How did you install Prowler?

From pip package (pip install prowler)

Environment Resource

1. EC2 instance
2. I search the log prowler gets with Splunk - Then I found the error 404. I guess the path prowler goes is incorrect.

OS used

1. Amazon Linux 2023

Prowler version

5.13.1

Python version

3.12

Pip version

pip3

Context

No response

[github-actions]

✅ Issue Triage completed successfully!

[github-actions]

AI Assessment [Experimental]: Bug

Component: CLI/SDK
Provider: OCI (Oracle Cloud Infrastructure)
Severity: high
Complexity: low
Agent Ready: Ready

Summary

The OCI audit log retention check fails with a 404 error because audit_service.py creates an AuditClient without specifying a region. The OCI Audit Configuration API (get_configuration) is a tenancy-level API that must be called against the home region or a properly configured regional endpoint. When no region is specified, the client uses a default region that may not have the audit configuration endpoint, causing a 404 Not Found error.

Extracted Issue Fields

• Reporter version: 5.13.1
• Install method: pip package
• Environment: EC2 instance, Amazon Linux 2023

Duplicates & Related Issues

None found

---

Root Cause Analysis

Symptom

The check audit_log_retention_period_365_days fails with a 404 error when calling the OCI Audit Configuration API, preventing the check from executing even when the actual OCI audit configuration is set correctly.

Location

• Service file: prowler/providers/oraclecloud/services/audit/audit_service.py
• Check file: prowler/providers/oraclecloud/services/audit/audit_log_retention_period_365_days/audit_log_retention_period_365_days.py
• Function: Audit.__get_configuration__() (lines 19-50)
• Failing API call: audit_client.get_configuration(compartment_id=self.audited_tenancy) (line 27-29)

Cause

In audit_service.py line 22, the code creates an AuditClient using:

audit_client = self._create_oci_client(oci.audit.AuditClient)

This call does not specify a config_overrides parameter to set the region. The _create_oci_client method (from service.py line 188-213) merges config_overrides with the session config, but when config_overrides is None, it uses the session's default region.

The OCI Audit Configuration API is a tenancy-level resource that must be accessed from a specific regional endpoint (typically the home region). Unlike Identity services (which explicitly check for home region in identity_service.py line 66), the Audit service does not filter regional clients or specify which region to use, causing the API call to fail with a 404 when directed to an incorrect endpoint.

Service Client Gap

The Audit service needs to determine the home region and create the AuditClient with an explicit region configuration. The provider tracks is_home_region on OCIRegion objects (models.py line 137) and other services like Identity use this to route API calls to the correct region.

Coding Agent Plan

Required Skills

Load these skills from AGENTS.md before starting:

• prowler-sdk-check — Understanding check and service architecture
• prowler-test-sdk — OCI service testing patterns with MagicMock
• pytest — Test structure and assertions
• tdd — Test-first development workflow

Test Specification

Write tests FIRST (TDD). The skills contain all testing conventions and patterns.

Test Scenario	Expected Result	Must FAIL today?
Service initializes with home region client	AuditClient created with home region config	Yes
API call succeeds with home region	Configuration retrieved without 404 error	Yes
Fallback when no home region found	Uses first available region	No (edge case)
404 error is caught and logged	Configuration defaults to 90 days, no crash	No (already working)

Test location: tests/providers/oraclecloud/services/audit/audit_service_test.py
Mock pattern: MagicMock on _create_oci_client to verify region parameter

Fix Specification

1. In audit_service.py __get_configuration__() method:

   • Before creating the AuditClient, identify the home region from self.audited_regions (filter where region.is_home_region == True)
   • If home region exists, pass config_overrides={"region": home_region.key} to _create_oci_client()
   • If no home region is found, use the first region in self.audited_regions as fallback
   • Add logger.info message indicating which region is being used for audit configuration

2. Pattern to follow: Reference identity_service.py lines 64-67 for home region filtering approach

Acceptance Criteria

• AuditClient is created with explicit home region configuration
• 404 errors are eliminated when audit configuration exists in OCI
• Check executes successfully and reports correct retention period
• Error handling preserves existing behavior (defaults to 90 days on API errors)
• All existing tests pass (pytest tests/providers/oraclecloud/services/audit/ -v)
• New test verifies home region selection logic

Files to Modify

File	Change Description
prowler/providers/oraclecloud/services/audit/audit_service.py	Add home region detection logic before creating AuditClient; pass region in config_overrides
tests/providers/oraclecloud/services/audit/audit_service_test.py	Add test verifying home region is used for AuditClient creation

Edge Cases

• No home region marked (multiple regions, none marked as home): Use first available region and log warning
• Single region audit (common in testing): Use that region without checking is_home_region flag
• Empty regions list (should not happen but defensive): Skip audit configuration retrieval, log error

---

Note: This assessment was generated automatically by the Prowler Issue Triage Agent (experimental). The coding agent plan provides a specification for implementing the fix using Test-Driven Development (TDD). The agent will load the required skills, write tests first, then implement the minimal fix to make tests pass.

AI generated by Issue Triage

[Ker102]

Hey, I noticed this hasn't had a PR linked yet — would it be okay if I took a crack at it? I've been working with OCI providers and this looks like the AuditClient just needs the home region passed through config_overrides (similar to how identity_service.py handles it). Happy to defer if someone's already working on it though.

[stonehenjii]

Hey, I noticed this hasn't had a PR linked yet — would it be okay if I took a crack at it? I've been working with OCI providers and this looks like the AuditClient just needs the home region passed through config_overrides (similar to how identity_service.py handles it). Happy to defer if someone's already working on it though.

We still don't have someone who is working on it. I'll rather happy if you crack at it. Then, can you share the result and how to fix that bug by the cracking you did?
Thank you.

[Ker102]

Alright i have submitted a fix, for this also ran tests which verify the fix. Let me know if it works

[HugoPBrito]

Alright i have submitted a fix, for this also ran tests which verify the fix. Let me know if it works

Hi @Ker102,
I left you a comment. Please let me know what you think.

[stonehenjii]

Alright i have submitted a fix, for this also ran tests which verify the fix. Let me know if it works

Hi @Ker102,
I left you a comment. Please let me know what you think.

Thanks, I'll do it soon. Then I'll also share you the result!!
Thanks for your help!