Log Retention requirements — check log retention values in your config

Flags log-retention values in Loki, CloudWatch, Elasticsearch ILM, S3 lifecycle and Kubernetes audit YAML that are shorter than PCI DSS 10.5.1, CERT-In 2022 or OMB M-21-31 require. Runs entirely in your browser — nothing is uploaded.

# log-retention: pci-dss
# Grafana Loki (loki-config.yaml)
limits_config:
  retention_period: 744h
  retention_stream:
    - selector: '{namespace="payments"}'
      priority: 1
      period: 168h
compactor:
  retention_enabled: true
---
# CloudFormation: API audit log group
Resources:
  ApiAuditLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /cde/api/audit
      RetentionInDays: 30
  AuditLogBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: cde-audit-logs
      LifecycleConfiguration:
        Rules:
          - Id: archive-then-expire
            Status: Enabled
            Transitions:
              - StorageClass: GLACIER
                TransitionInDays: 30
            ExpirationInDays: 180
---
# kube-apiserver static pod (excerpt)
spec:
  containers:
    - command:
        - kube-apiserver
        - --audit-log-path=/var/log/kubernetes/audit.log
        - --audit-log-maxage=30
---
# Elasticsearch ILM policy (YAML via ECK / Kibana API)
policy:
  phases:
    hot:
      actions:
        rollover:
          max_age: 7d
    delete:
      min_age: 90d
      actions:
        delete: {}

as of

Free here: Every retention finding in the open YAML file, with the clause and the value that passes, no key needed. In the editor: Workspace evidence report: every log store's retention across all YAML files in one Markdown table (value, minimum, clause) for your QSA or auditor. — that part asks for a licence key. · one licence key per person or team seat.

Same engine as the VS Code extension, byte for byte.