# 3.8 Ensure that object-level logging for write events is enabled for S3 buckets (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000234253-3-8-ensure-that-object-level-logging-for-write-events-is-enabled-for-s3-buckets-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Web Services Foundations Benchmark v5.0.0](https://support.icompaas.com/support/solutions/62000112684) › [CIS AWS Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169233) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability: - **Level 1** #### Description: Object-level logging for write events in Amazon S3 tracks all write operations (e.g., PUT, POST, DELETE) made to objects within an S3 bucket. Enabling this logging is essential for auditing and tracking changes to sensitive objects in S3, such as additions, modifications, and deletions. When object-level logging is enabled for write events, organizations gain visibility into operations that modify object data, helping to detect and respond to unauthorized changes or accidental deletions. This feature is especially important for compliance with regulatory requirements like GDPR, HIPAA, and SOC 2, where detailed tracking of data modifications is necessary. #### Rationale: Tracking write events in S3 provides the following benefits: - Visibility into operations that modify S3 objects. - Auditability of who made changes to sensitive data, enhancing accountability. - Security monitoring to detect unauthorized or malicious write operations. - Compliance with regulations requiring detailed logging of data modifications. Without object-level logging for write events, organizations cannot track changes to objects, making it harder to detect malicious activity, accidental data loss, or unauthorized access. #### Impact: Failure to enable object-level logging for write events can result in: - Loss of visibility into the modification or deletion of objects. - Inability to track unauthorized changes to sensitive data. - Non-compliance with regulatory standards that require detailed data modification tracking. Enabling this logging ensures that all write operations to objects are captured for audit purposes. #### Default Value: By default, object-level logging for write events is not enabled on S3 buckets. It must be explicitly configured through S3 bucket settings or via AWS Config to track write events such as PUT, POST, or DELETE requests. #### Pre-Requisites: - AWS CLI installed and configured - IAM permissions: - s3:GetBucketLogging - s3:PutBucketLogging - config:DescribeConfigurationRecorder - AWS Config should be enabled to track the state of S3 bucket logging #### Remediation: ##### Test Plan: Using AWS Console: 1. Go to the [S3 Console](https://console.aws.amazon.com/s3/). 2. Navigate to the S3 bucket where you want to enable object-level logging for write events. 3. In the Properties section of the bucket, under Server access logging, ensure that Object-level logging for write events is enabled. 4. Go to the [AWS Config Console](https://console.aws.amazon.com/config/) and verify that the Configuration Recorder is active and tracking S3 bucket logging configurations. Using AWS CLI: aws s3api get-bucket-logging --bucket --query "LoggingEnabled" --output table To verify if AWS Config is tracking S3 bucket logging configurations: aws configservice describe-configuration-recorders --query "ConfigurationRecorders\[?recordingGroup.allSupported==\`true\`\].{Name:name, RecordingGroup:recordingGroup}" --output table ##### Implementation Plan: Using AWS Console: 1. Enable object-level logging for S3 buckets: - Go to the [S3 Console](https://console.aws.amazon.com/s3/). - Select the S3 bucket where you want to enable logging. - Under the Properties tab, go to Server access logging. - Enable logging, and ensure that the Log file prefix is set to differentiate logs for write operations. 2. Enable AWS Config to track bucket logging configurations: - In the [AWS Config Console](https://console.aws.amazon.com/config/), ensure the Configuration Recorder is active and tracking S3 bucket logging configurations. Using AWS CLI: 1. Enable object-level logging for S3 bucket: aws s3api put-bucket-logging --bucket --bucket-logging-status '{"LoggingEnabled": {"TargetBucket": "", "TargetPrefix": "logs/"}}' 2. Enable AWS Config to monitor S3 bucket logging: aws configservice record-configuration-changes --configuration-recorder-name --include-configuration-item-types "AWS::S3::Bucket" #### Backout Plan: Using AWS Console: 1. If object-level logging for write events causes excessive logging or performance issues: - Go to the [S3 Console](https://console.aws.amazon.com/s3/). - Disable Server access logging for the S3 bucket. - Alternatively, adjust the frequency or scope of the logging configuration if it is generating too many logs. 2. Modify AWS Config settings to exclude logging configurations if it causes performance or resource consumption issues. Using AWS CLI: 1. Temporarily disable object-level logging: aws s3api put-bucket-logging --bucket --bucket-logging-status '{}' 2. Stop recording S3 bucket logging configurations in AWS Config: aws configservice stop-configuration-recorder --configuration-recorder-name 3. Re-enable monitoring once issues are resolved: aws s3api put-bucket-logging --bucket --bucket-logging-status '{"LoggingEnabled": {"TargetBucket": "", "TargetPrefix": "logs/"}}' aws configservice start-configuration-recorder --configuration-recorder-name #### References: - [AWS S3 Documentation ](https://docs.aws.amazon.com/AmazonS3/latest/userguide/LoggingUsingCloudTrail.html) - [AWS CloudTrail Documentation ](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) - [AWS Config Documentation ](https://docs.aws.amazon.com/config/latest/developerguide/) #### CIS Controls Mapping:

CIS Control Version	Control ID	Control Description
CIS v8	4.9	Perform Continuous Security Monitoring and Incident Detection
CIS v7	6.3	Monitor Security Configurations for Compliance
CIS v7	5.2	Securely Manage and Monitor Cloud Accounts and Services

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.