[Documentation] fast/stages-aw/0-bootstrap: terraform.tfvars.sample states Cloud Logging buckets have "30-day default retention" four lines after stating the default is 365

[JohnHales]

Description of Documentation Need

fast/stages-aw/0-bootstrap/terraform.tfvars.sample makes two incompatible statements about log retention, four lines apart, and the second one is wrong for this stage.

# terraform.tfvars.sample:27-28
# Retention period (in days) for organization logging buckets (defaults to 365 days for compliance)
# logging_bucket_retention = 365

# terraform.tfvars.sample:32
# Default log routing is set to "logging" (Cloud Logging buckets with 30-day default retention)

The 365 figure is the correct one. variables.tf:259-263 declares logging_bucket_retention with default = 365 and the description "Retention period (in days) for the Cloud Logging buckets created for organization log exports", and log-export.tf:104-113 applies it to every bucket the stage creates — module "log-export-logbucket" iterates for_each = toset([for k, v in var.log_sinks : k if v.type == "logging"]) and sets retention = var.logging_bucket_retention. The sample itself ships four type = "logging" sinks (audit-logs, vpc-sc, workspace-audit-logs, empty-audit-logs), so on a default apply all four buckets are created at 365 days.

Thirty days is the retention of the Cloud Logging _Default bucket, which is a platform default this stage does not use and does not leave in place for these sinks. Nothing in 0-bootstrap produces a 30-day bucket.

Target Audience

Operators and partner architects reading the sample to decide what to override before their first apply — and, downstream of them, whoever has to state an audit-log retention period to a customer or an assessor. terraform.tfvars.sample is the file people actually read when planning a deployment; the variable descriptions in variables.tf are consulted later, if at all. A reader who takes the comment at face value will under-state the retention their own deployment delivers by a factor of twelve, and may add an override, a follow-on log sink, or a remediation item to correct a shortfall that does not exist.

Proposed Location

fast/stages-aw/0-bootstrap/terraform.tfvars.sample, the log_sinks comment block at lines 32-34.

Content Outline / Draft

Correct the retention clause and keep the routing guidance that follows it:

# Default log routing is set to "logging" (Cloud Logging buckets, retained for
# logging_bucket_retention days — see above; the default is 365)
# To use long-term storage, change type to "storage" (GCS) or "bigquery"
# To route to a SIEM, use "pubsub" (note: requires active subscriber to avoid log loss after 7 days)

Removing the parenthetical entirely would also fix it — the retention default is already stated four lines earlier, which is what makes the contradiction so easy to hit.

Compliance Context (if applicable)

No control is mis-implemented: the stage retains 365 days, which is what its own variable promises "for compliance". The problem is purely what the document asserts. Audit-record retention is a claim that ends up in customer-facing design documents and assessment evidence, and this is the one file a reader is most likely to quote it from — so a wrong number here propagates further than its severity suggests. Applies to every regime the stage serves (FedRAMP High, FedRAMP Moderate, IL4, IL5), since 0-bootstrap is shared.