# Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible - Source: https://support.icompaas.com/support/solutions/articles/62000086110-ensure-the-s3-bucket-used-to-store-cloudtrail-logs-is-not-publicly-accessible - Section: [Solutions](https://support.icompaas.com/support/solutions) › [HIPAA Readiness](https://support.icompaas.com/support/solutions/62000039493) › [CIS Control 14.6](https://support.icompaas.com/support/solutions/folders/62000067249) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Profile Applicability:** Level 1 **Description:**  CloudTrail logs are a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. By default, Amazon S3 buckets and objects are private. Only the resource owner (the AWS account that created the bucket) can access the bucket and the objects it contains. The resource owner can grant access permissions to other resources and users by writing an access policy. If you want to create or modify an Amazon S3 bucket to receive the log files for an organization trail, you must further modify the bucket policy **Rationale:**  Allowing public access to CloudTrail log content may aid an adversary in identifying weaknesses in the affected account's use or configuration. ### Impact: It is recommended that the bucket policy, or Access Control List (ACL), be applied to the S3 bucket that CloudTrail logs to prevent public access to the CloudTrail logs. **Default Value:**  By default, S3 buckets are not publicly accessible. #### Pre-Requisite:  1. Log in as an admin or IAM user with the required permissions 2. If you found s3 bucket with public access then only follow the implementation 3. Make note of all the permissions that exist as backout **Remediation:** **Test Plan:**  Perform the following to determine if any public access is granted to an S3 bucket via an ACL or S3 bucket policy: Via the Management Console. 1. Go to the Amazon CloudTrail console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail "https://console.aws.amazon.com/cloudtrail")  2\. In the APP activity history pane on the left, click Trails. ![](https://support.icompaas.com/assets/kb/b21a721154ca0928.png) 3\. In the Trails pane, note the bucket names in the S3 bucket column  4\. Go to Amazon S3 console at  [https://s3.console.aws.amazon.com/s3](https://s3.console.aws.amazon.com/s3 "https://s3.console.aws.amazon.com/s3") 5\. For each bucket noted in step 3, click on the bucket  6\. Click on the **Permissions tab**. ![](https://support.icompaas.com/assets/kb/ad0ba6a0336b1f41.png)7\. Go to the **Block Public Access** and check if it off or on  ![](https://support.icompaas.com/assets/kb/ae31ffd2436e1175.png) **CLI commands** It will give bucket is public access or not aws cloudtrail describe-trails **Implementation:** Perform the following to remove any public access that has been granted to the bucket via an ACL or S3 bucket policy:  1. Go to Amazon S3 console at [https://console.aws.amazon.com/s3](https://console.aws.amazon.com/s3/home%C2%A0 "https://console.aws.amazon.com/s3/home%C2%A0") 2. Select the bucket that you found in the audit section to edit 3. Click on the **Permissions tab.** **![](https://support.icompaas.com/assets/kb/8c30786f832d0ac5.png)**   4. Click on **Edit** under the **Block public access** section ![](https://support.icompaas.com/assets/kb/137b463be2a9d717.png)  5. Check the **Block all public access** check Box and click on **save changes** ![](https://support.icompaas.com/assets/kb/50bf4a8cf26d5e4f.png) ![](https://support.icompaas.com/assets/kb/d147d5ab45c046e4.png) **CLI commands** It will change the bucket logging into private aws s3api put-bucket-acl --bucket cloudtrail-global-logging --acl private #### Backout Plan: 1. Go to Amazon S3 console at [https://console.aws.amazon.com/s3](https://console.aws.amazon.com/s3/home%C2%A0 "https://console.aws.amazon.com/s3/home%C2%A0") 2. Select the bucket that you found in audit section to edit 3. Click on the **Permissions tab.** ![](https://support.icompaas.com/assets/kb/5352b58e66ddab2d.png)  4\. Click on **Edit** under the **Block public access** section. ![](https://support.icompaas.com/assets/kb/4c17985b3960e2de.png) 5. Uncheck the **Block all public access** check box and click on **"Save Changes".** **![](https://support.icompaas.com/assets/kb/d74d4edfed7f09e5.png)** **Using AWS CLI Commands**  It will change the bucket to public access. aws s3api put-public-access-block --bucket --public-access-block-configuration "{\\"IgnorePublicAcls\\": true}" **References:**  1\. CCE-78915-6  2\. [https://docs.aws.amazon.com/IAM/latest/UserGuide/reference\_policies\_elements\_](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_)principal.html **CIS Controls:** 14.6 Protect Information through Access Control Lists  Protect all information stored on systems with file system, network share, claims, application, or database specific access control lists. These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities. ## Related compliance guidance - [HIPAA compliance for SaaS: a practical implementation guide](https://support.icompaas.com/compliance/hipaa): The Security Rule safeguards this readiness item belongs to, with a phased implementation roadmap and the evidence OCR expects. - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Most healthcare customers ask for a SOC 2 report alongside HIPAA assurances; the two share most technical controls.