Control: 3.6 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket
Description
AWS S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.
By enabling S3 bucket logging on target S3 buckets, it is possible to capture all events which may affect objects within any target buckets. Configuring logs to be placed in a separate bucket allows access to log information which can be useful in security and incident response workflows.
Remediation
Perform the following to enable S3 bucket logging:
From Console
- Open the Amazon S3 console at S3.
- Choose the bucket used for CloudTrail.
- Choose Properties.
- Choose Server access logging.
- Choose Edit, then select
Enable. - Select a bucket from the
Target bucketlist, and optionally enter a prefix. - Choose Save.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.cis_v140_3_6Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.cis_v140_3_6 --shareSQL
This control uses a named query:
cloudtrail_s3_logging_enabled