lacework-global-56
3.6 Enable S3 bucket access logging on the CloudTrail S3 bucket (Automated)
Profile Applicability
• Level 1
Description
S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date of processing the request. Best practices recommend enabling bucket access logging on the CloudTrail S3 bucket.
Rationale
By enabling S3 bucket logging on target S3 buckets, it is possible to capture all events which may affect objects within any target buckets. Configuring logs to be placed in a separate bucket allows access to log information which can be useful in security and incident response workflows.
Audit
Perform the following ensure the CloudTrail S3 bucket has access logging is enabled:
From Console
- Go to the Amazon CloudTrail console at https://console.aws.amazon.com/cloudtrail/home.
- In the API activity history pane on the left, click Trails.
- In the Trails pane, note the bucket names in the S3 bucket column.
- Sign in to the AWS Management Console and open the S3 console at https://console.aws.amazon.com/s3.
- Under
All Buckets
click on a target S3 bucket. - Click on
Properties
in the top right of the console. - Under
Bucket: <bucket_name>
, click onLogging
. - Ensure
Enabled
is checked.
From Command Line
- Get the name of the S3 bucket that CloudTrail is logging to:
aws cloudtrail describe-trails --query 'trailList[*].S3BucketName'
- Ensure Bucket Logging is enabled:
aws s3api get-bucket-logging --bucket <s3_bucket_for_cloudtrail>
Ensure command does not returns empty output.
Sample Output for a bucket with logging enabled:
{
"LoggingEnabled": {
"TargetPrefix": "<Prefix_Test>",
"TargetBucket": "<Bucket_name_for_Storing_Logs>"
}
}
Remediation
Perform the following to enable S3 bucket logging:
From Console
- Sign in to the AWS Management Console and open the S3 console at https://console.aws.amazon.com/s3.
- Under
All Buckets
click the target S3 bucket. - Click
Properties
in the top right of the console. - Under
Bucket: <s3_bucket_for_cloudtrail>
, clickLogging
. - Configure bucket logging:
- Click Enabled checkbox
- Select Target Bucket from list
- Enter a Target Prefix
- Click
Save
.
References
CCE-78918-0
https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerLogs.html