turbot/aws_compliance
Loading controls...

Control: 9 S3 bucket server access logging should be enabled

Description

When logging is enabled, Amazon S3 delivers access logs for a source bucket to a chosen target bucket. The target bucket must be in the same AWS Region as the source bucket and must not have a default retention period configuration. The target logging bucket does not need to have logging enabled. This control passes if Server access logging is enabled.

Server access logging provides detailed records of requests made to a bucket. Server access logs can assist in security and access audits. For more information, see Security Best Practices for Amazon S3: Enable Amazon S3 server access logging.

Remediation

To enable S3 bucket access logging

  1. Sign in to the AWS Management Console and open the Amazon S3 console.
  2. Choose the bucket used for CloudTrail.
  3. Choose Properties.
  4. Choose Server access logging, then select Edit.
  5. Under Server access logging choose Enable then choose Save changes.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_s3_9

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_s3_9 --share

SQL

This control uses a named query:

s3_bucket_logging_enabled

Tags