# Ensure S3 buckets have server access logging enabled

- Source: https://support.icompaas.com/support/solutions/articles/62000236263-ensure-s3-buckets-have-server-access-logging-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Profile Applicability:**

-   Level 1

  

### **Description:**

This control ensures that Amazon S3 Server Access Logging is enabled for all S3 buckets that store critical or sensitive data. Server Access Logging provides detailed records of requests made to a bucket — including the requester, bucket name, request type, response status, and error codes. These logs are invaluable for auditing, security investigations, and compliance verification.

  

### **Rationale:**

Server access logs allow organizations to:

-   Monitor and analyze access patterns to detect unusual or unauthorized activity.
    
-   Investigate incidents involving data exfiltration or policy violations.
    
-   Meet compliance requirements for access auditing (e.g., SOC 2, ISO 27001, GDPR).
    

Without access logging, any unauthorized or anomalous access to bucket data may go undetected, increasing security and compliance risks.

  

### **Impact:**

-   Positive Impact:Enables detailed audit trails for forensic and compliance investigations.Improves visibility into data access and usage behavior.Facilitates proactive threat detection and access anomaly identification.
-   Negative Impact:Increases S3 storage costs for logs.Requires management of log destination buckets to prevent circular logging.

  

### **Default Value:**

By default, S3 Server Access Logging is disabled. It must be explicitly enabled for each S3 bucket.

  

### **Pre-Requisite:**

-   IAM permissions required:
    
    -   `s3:GetBucketLogging`
        
    -   `s3:PutBucketLogging`
        
    -   `s3:ListAllMyBuckets`
        
-   A designated target logging bucket with write permissions from the source bucket.
    
    -   The logging bucket should not be the same as the source bucket (to prevent recursive logging).
        

###   

### **Remediation**

#### **Test Plan**

### **Using AWS Console:**

1.  Sign in to the AWS Management Console.
    
2.  Navigate to Amazon S3 → Buckets.
    
3.  Select a bucket.
    
4.  Under the Properties tab, scroll to Server access logging.
    
5.  Check whether logging is Enabled.
    
6.  If disabled, note the bucket name and follow the implementation steps to enable it.
    

###   

### **Implementation Plan**

#### **Using AWS Console:**

1.  Navigate to Amazon S3 → Buckets.
    
2.  Select the source bucket for which you want to enable logging.
    
3.  Go to the Properties tab.
    
4.  Scroll to Server access logging and click Edit.
    
5.  Enable Server access logging.
    
6.  Under Target bucket, choose a different S3 bucket to store the access logs.
    
    -   (If necessary, create a new bucket such as `s3-access-logs`.)
        
7.  Optionally, specify a Target prefix (e.g., `logs/`) for log organization.
    
8.  Click Save changes.
    

###   

### **Backout Plan**

#### **Using AWS Console:**

1.  Navigate to Amazon S3 → Buckets → \[Your Bucket\] → Properties.
    
2.  Scroll to Server access logging.
    
3.  Click Edit, and disable Server access logging.
    
4.  Save changes.
    

  

### **References:**

-   [Amazon S3 Server Access Logging Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html)
    
-   [AWS CLI Command Reference – s3api put-bucket-logging](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-logging.html)
    
-   [CIS AWS Foundations Benchmark v2.0.0 – Control 3.22](https://www.cisecurity.org/benchmark/amazon_web_services)
    
-   [AWS S3 Security Best Practices](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.